SiYuan Note Stored Cross-Site Scripting Vulnerability via Unrestricted SVG Upload

A stored cross-site scripting vulnerability has been identified in SiYuan Note versions prior to 3.5.4-dev2. The issue arises because the application fails to sanitize uploaded SVG files, allowing users to execute arbitrary JavaScript in the context of their authenticated session. This vulnerability can be exploited by uploading a malicious SVG file, which is then processed by the application without proper security checks.

Impact

Exploitation of this vulnerability allows for the execution of embedded JavaScript in the user's browser, potentially leading to unauthorized actions or data exposure within the context of the user's session.

Reproduction

To reproduce this vulnerability, upload a malicious SVG file containing JavaScript into a note. Once the file is uploaded, export it, and the embedded script will execute in the browser.

Remediation

Users can update to SiYuan version 3.5.4-dev2 or later, where this vulnerability has been fixed.