CRITICAL9.3Go
GHSA-4mx9-3c2h-hwhg· CVE-2026-32940, GO-2026-4721SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
Modified: 4/2/2026
package
Go/github.com/siyuan-note/siyuan
pkg:go/github.com/siyuan-note/siyuan
MEDIUM6.8Go
GHSA-rjhh-m223-9qqv· CVE-2026-32750, GO-2026-4708SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes
Modified: 3/30/2026
—Go
GO-2026-4708· CVE-2026-32750, GHSA-rjhh-m223-9qqvSiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan
Modified: 3/26/2026
—Go
GO-2026-4721· CVE-2026-32940, GHSA-4mx9-3c2h-hwhgSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) in github.com/siyuan-note/siyuan
Modified: 3/26/2026