{"id":"CVE-2026-23645","aliases":["GHSA-pcjq-j3mq-jv5j","GO-2026-4324"],"url":"https://o3.security/vulnerability/CVE-2026-23645","summary":"SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload","details":"### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session.\n\n### Details\nThe application allows authenticated users to upload files, including .svg images, without sanitizing the input to remove embedded JavaScript code (such as <script> tags or event handlers).\n\n### PoC\n1. Create a new \"Daily note\" in the workspace.\n<img width=\"1287\" height=\"572\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3a4389b9-695d-4e1b-94dc-72efdb047aa9\" />\n2. Create a file named  test.svg with malicious JavaScript inside:\n\n```\n<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"200\" viewBox=\"0 0 124 124\" fill=\"none\">\n<rect width=\"124\" height=\"124\" rx=\"24\" fill=\"red\"/>\n   <script type=\"text/javascript\">  \n      alert(window.origin);\n   </script>\n</svg>\n```\n3. Upload a file in current daily note:\n<img width=\"1617\" height=\"316\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6e14318a-08ec-48e5-b278-9174ad17cfcb\" />\n<img width=\"1482\" height=\"739\" alt=\"image\" src=\"https://github.com/user-attachments/assets/95c996e8-5591-436a-9467-ab56c9ffbde0\" />\n<img width=\"1321\" height=\"548\" alt=\"image\" src=\"https://github.com/user-attachments/assets/249fb187-3caa-4372-a9c9-56dfda6b8a8f\" />\n4. Open the file:\n\n- Right-click the uploaded asset in the note.\n- Select \"Export\"\n<img width=\"934\" height=\"718\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ec943dfa-92ba-47f6-8b1e-56e53f1b0ca6\" />\n5. The JavaScript code executes immediately.\n<img width=\"1033\" height=\"632\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a1611291-d333-4f8e-9da9-62104aaa1bdd\" />\n<img width=\"1381\" height=\"641\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d5018203-dbd0-4285-8702-8cb3e7c5cd07\" />\n\n### Impact\nThe vulnerability allows  to upload an SVG file containing malicious scripts. When a user  exports this file, the embedded arbitrary JavaScript code is executed within their browser context\n\n###  Notes\nTested  version: \n<img width=\"1440\" height=\"534\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a62271e4-6850-4f59-be88-c4f8055429c0\" />\n\n### Solution\n\nhttps://github.com/siyuan-note/siyuan/issues/16844","published":"2026-01-16T19:20:06.744Z","modified":"2026-10-28T02:30:22.044402732Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","fixedVersion":"0.0.0-20260116101155-11115da3d0de"}],"fix":{"url":"https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388","label":"siyuan-note/siyuan@11115da"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23645.json"},{"type":"ADVISORY","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23645"},{"type":"REPORT","url":"https://github.com/siyuan-note/siyuan/issues/16844"},{"type":"FIX","url":"https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:22.044402732Z"}}