SiYuan knowledge management systems are vulnerable to a critical click-through XSS attack that can lead to unauthorized JavaScript execution via malicious SVG files.

The /api/icon/getDynamicIcon endpoint serves user-controlled input directly into SVG markup without escaping. The sanitization process misses certain XML MIME types, allowing an unauthenticated attacker to craft a URL that, when clicked by a victim, executes JavaScript within the context of the application.

A successful Cross-Site Scripting (XSS) attack can allow an attacker to steal session cookies, perform actions on behalf of the user, or deface the application. Although it requires a "click-through," the high CVSS score of 9.3 highlights the significant risk to user data and the potential for session hijacking in a knowledge-heavy environment.

Immediate Action: Update SiYuan to version 3.6.1 or later to implement the corrected SVG sanitization logic and input escaping.

Proactive Monitoring: Inspect application logs for unusual parameters being passed to the dynamic icon API and monitor for reports of suspicious links within the SiYuan community.

Compensating Controls: Implement a strong Content Security Policy (CSP) that restricts the execution of inline scripts and prevents the loading of objects from untrusted origins.

Public Exploit Available: No

The risk of XSS in a productivity tool like SiYuan is substantial. Users should update to version 3.6.1 immediately. Until the patch is applied, users should be warned against clicking on unknown links that point to their SiYuan instance's dynamic icon API.