GitStock

siyuan-note/siyuan · Security

SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

GHSA ID
GHSA-w836-5gpm-7r93
CVE ID
CVE-2026-23847
Severity
low
Published
Updated
CVSS
4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v3
4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4
2.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

Description

Summary

Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input.

Details

The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.

PoC

Payload: test</text><script>alert(window.origin)</script><text>

  1. Open any note and click Change Icon -> Dynamic (Text).

  2. Change color and paste the payload into the Custom field and click on this icon.

  3. Intercept and send the request or get path from devtools

  4. The JavaScript payload executes afted open URL.

Impact

Arbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like < or > in icon text.

Note

Tested version:

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

Open GitHub