{"id":"CVE-2026-23847","aliases":["GHSA-w836-5gpm-7r93","GO-2026-4343"],"url":"https://o3.security/vulnerability/CVE-2026-23847","summary":"SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon","details":"### Summary\nReflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input.\n### Details\nThe endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.\n\n### PoC\nPayload: `test</text><script>alert(window.origin)</script><text>`\n\n1. Open any note and click Change Icon -> Dynamic (Text).\n<img width=\"713\" height=\"373\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8a4f5ec4-81d6-46cb-8872-841cb2188ed8\" />\n\n2.  Change color  and paste the payload into the Custom field and click on this icon.\n<img width=\"935\" height=\"682\" alt=\"image\" src=\"https://github.com/user-attachments/assets/24d28fbd-a3ce-44f1-a5bb-2cc3f711faf5\" />\n\n3. Intercept and send the request or get path from devtools \n<img width=\"1229\" height=\"627\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3cfb1d9a-5a23-476c-86cc-f9a7de6bbe32\" />\n<img width=\"1140\" height=\"764\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2657e44f-3724-4136-a53f-75068945aef0\" />\n\n4. The JavaScript payload executes afted open URL.\n<img width=\"701\" height=\"809\" alt=\"image\" src=\"https://github.com/user-attachments/assets/343ad67a-e236-466b-9ec9-e4f1dea4fd5e\" />\n<img width=\"1382\" height=\"847\" alt=\"image\" src=\"https://github.com/user-attachments/assets/01820d3c-c374-402a-8d72-6ea75dbd92c2\" />\n\n### Impact\nArbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like < or > in icon text.\n\n### Note\nTested version:\n<img width=\"1368\" height=\"699\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a7466b8f-a88b-461d-8d9e-7178af7ab076\" />","published":"2026-01-19T19:46:08.980Z","modified":"2026-10-28T02:30:56.565918741Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","fixedVersion":"0.0.0-20260118021606-5c0cc375b475"}],"fix":{"url":"https://github.com/siyuan-note/siyuan/commit/5c0cc375b47567e15edd2119066b09bb0aa18777","label":"siyuan-note/siyuan@5c0cc37"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23847.json"},{"type":"ADVISORY","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w836-5gpm-7r93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23847"},{"type":"REPORT","url":"https://github.com/siyuan-note/siyuan/issues/16844"},{"type":"FIX","url":"https://github.com/siyuan-note/siyuan/commit/5c0cc375b47567e15edd2119066b09bb0aa18777"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:56.565918741Z"}}