XSS in Siyuan-note Siyuan

CVE-2026-31807

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. Howe…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (59.6th percentile) — read the EPSS interpretation.