{"id":"GHSA-w836-5gpm-7r93","summary":"SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon","details":"### Summary\nReflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input.\n### Details\nThe endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG \u003ctext\u003e tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.\n\n### PoC\nPayload: `test\u003c/text\u003e\u003cscript\u003ealert(window.origin)\u003c/script\u003e\u003ctext\u003e`\n\n1. Open any note and click Change Icon -\u003e Dynamic (Text).\n\u003cimg width=\"713\" height=\"373\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8a4f5ec4-81d6-46cb-8872-841cb2188ed8\" /\u003e\n\n2.  Change color  and paste the payload into the Custom field and click on this icon.\n\u003cimg width=\"935\" height=\"682\" alt=\"image\" src=\"https://github.com/user-attachments/assets/24d28fbd-a3ce-44f1-a5bb-2cc3f711faf5\" /\u003e\n\n3. Intercept and send the request or get path from devtools \n\u003cimg width=\"1229\" height=\"627\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3cfb1d9a-5a23-476c-86cc-f9a7de6bbe32\" /\u003e\n\u003cimg width=\"1140\" height=\"764\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2657e44f-3724-4136-a53f-75068945aef0\" /\u003e\n\n4. The JavaScript payload executes afted open URL.\n\u003cimg width=\"701\" height=\"809\" alt=\"image\" src=\"https://github.com/user-attachments/assets/343ad67a-e236-466b-9ec9-e4f1dea4fd5e\" /\u003e\n\u003cimg width=\"1382\" height=\"847\" alt=\"image\" src=\"https://github.com/user-attachments/assets/01820d3c-c374-402a-8d72-6ea75dbd92c2\" /\u003e\n\n### Impact\nArbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like \u003c or \u003e in icon text.\n\n### Note\nTested version:\n\u003cimg width=\"1368\" height=\"699\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a7466b8f-a88b-461d-8d9e-7178af7ab076\" /\u003e","aliases":["CVE-2026-23847","GO-2026-4343"],"modified":"2026-02-03T22:41:16.355589Z","published":"2026-01-21T01:00:44Z","database_specific":{"nvd_published_at":"2026-01-19T20:15:49Z","cwe_ids":["CWE-79"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-01-21T01:00:44Z"},"references":[{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w836-5gpm-7r93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23847"},{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/issues/16844"},{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/commit/5c0cc375b47567e15edd2119066b09bb0aa18777"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"}],"affected":[{"package":{"name":"github.com/siyuan-note/siyuan/kernel","ecosystem":"Go","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260118021606-5c0cc375b475"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-w836-5gpm-7r93/GHSA-w836-5gpm-7r93.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P"}]}