Vulnerability · Published Jan 19, 2026 · Assigned by GitHub_M

CVE-2026-23847SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

Low 2.1

In plain English

A low-severity cross-site scripting in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.3%top 75.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260118021606-5c0cc375b475	GHSA-w836-5gpm-7r93
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260118021606-5c0cc375b475	GO-2026-4343

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	< 3.5.4

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w836-5gpm-7r93 x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/issues/16844 x_refsource_MISC
https://github.com/siyuan-note/siyuan/commit/5c0cc375b47567e15edd2119066b09bb0aa18777 x_refsource_MISC