CVE-2026-66394

Affected software: SiYuan prior to v3.7.3. Vulnerability: stored and reflected XSS via SVG sanitization bypassing the HTML parser-based cleaner, allowing authenticated attackers to run scripts. Trigger/context: scripts can be executed in the application origin when served as image/svg+xml by hidi...