The vulnerability allows an attacker to upload a crafted SVG file that the application fails to sanitize. When a legitimate user opens the file, arbitrary JavaScript runs within the context of that user’s authenticated session, potentially stealing session credentials or manipulating the user’s data. The weakness is a classic stored XSS, matching the CWE‑79 classification.

The flaw affects versions of Siyuan Note prior to 3.5.4‑dev2, including the 3.5.4‑dev1 release. It is present in the open‑source self‑hosted knowledge‑management software developed by B3log.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % signals a low likelihood of exploitation at this time. The bug is not listed in the Current Exploited Vulnerabilities catalog, so no known widespread attacks are reported. Exploitation requires a user with upload privileges to deliver the malicious SVG; once the file is processed, the attacker can execute code in that user’s browser.