The SanitizeSVG function introduced in version 3.6.0 of the personal knowledge management system was designed to block disallowed SVG elements when an unprivileged user requested icons from /api/icon/getDynamicIcon. Between versions 3.6.0 and just before 3.6.2 the sanitiser failed to recognise elements whose tag names were prefixed with a namespace, such as <x:script xmlns:x="http://www.w3.org/2000/svg">. The Go HTML5 parser records the tag as "x:script" and the sanitiser compares it only against the exact string "script", allowing the element to pass through. The resulting SVG is served with the content type image/svg+xml and no Content‑Security‑Policy. When a browser loads the response directly, it resolves the prefix to the SVG namespace and executes the embedded script, enabling an attacker to run arbitrary JavaScript in the context of any user who opens the returned SVG.

Siyuan Note versions 3.6.0 through 3.6.1 are affected; version 3.6.2 and later contain the patch that removes the vulnerable path.

The CVSS base score of 8.6 signals high severity. With an EPSS score of 1 % the likelihood of exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by making a direct request to the public endpoint, receiving the malicious SVG, and causing a user agent to parse it, which would execute arbitrary client‑side code with the privileges of the viewing user.