SiYuan before version 3.7.3 contains a stored and reflected cross‑site scripting (CWE‑79) flaw in its SVG handling routine. The sanitizer that normally removes potentially dangerous markup fails to strip script tags placed inside desc, style, or noscript elements of an SVG. When these SVG files are served with the MIME type image/svg+xml, browsers treat the hidden script content as executable SVG elements, allowing an attacker to run arbitrary JavaScript within the context of the application origin. An attacker who can authenticate to the system can embed such an SVG in a note or upload it, and any authenticated viewer of that note will execute the injected script. This yields full abuse of the victim’s browser, enabling credential theft, session hijacking, or defacement.

The vulnerability affects the SiYuan note‑taking application, released by vendor siyuan-note. All releases prior to version 3.7.3 are vulnerable. Versions 3.7.3 and later contain the corrected SVG sanitizer and are not affected. No other versions are listed as affected.

With a CVSS score of 9.3 the risk is considered Critical. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known exploits yet. The likely attack vector requires an authenticated user to upload or embed a malicious SVG file, benefiting from the application’s trust in authenticated content. Once uploaded, any other authenticated user who views the note triggers script execution. Therefore, the exploit is realistic in environments where users can share notes or where administrators use the application to host information freely.