Detections
Analytics

SCA: security update for github.com/siyuan-note/siyuan/kernel (GHSA-5hc8-qmg8-pw27)

medium Tenable Self-Hosted Container Security Plugin ID 438605

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG)
 blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and
 javascript: in href attributes. However, it does NOT block SVG animation elements (<animate>, <set>) which
 can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This
 allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon
 endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in
 v3.5.9). This vulnerability is fixed in v3.5.10. (CVE-2026-31807)

Solution

Update the github.com/siyuan-note/siyuan/kernel library and its related packages to version 0.0.0-20260310025236-297bd526708f or later.

See Also

https://github.com/advisories/GHSA-5hc8-qmg8-pw27

Plugin Details

Severity: Medium

ID: 438605

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 3/11/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-31807

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.4

Threat Score: 5.4

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/10/2026

Vulnerability Publication Date: 3/10/2026

Reference Information

CVE: CVE-2026-31807

cwe: CWE-79