CVE-2026-23847: Github.com/siyuan note/siyuan/kernel Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-w836-5gpm-7r93",
  "modified" : "2026-01-21T01:00:44Z",
  "published" : "2026-01-21T01:00:44Z",
  "aliases" : [ "CVE-2026-23847" ],
  "summary" : "SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon",
  "details" : "### Summary\nReflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input.\n### Details\nThe endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.\n\n### PoC\nPayload: `test</text><script>alert(window.origin)</script><text>`\n\n1. Open any note and click Change Icon -> Dynamic (Text).\n<img width=\"713\" height=\"373\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8a4f5ec4-81d6-46cb-8872-841cb2188ed8\" />\n\n2.  Change color  and paste the payload into the Custom field and click on this icon.\n<img width=\"935\" height=\"682\" alt=\"image\" src=\"https://github.com/user-attachments/assets/24d28fbd-a3ce-44f1-a5bb-2cc3f711faf5\" />\n\n3. Intercept and send the request or get path from devtools \n<img width=\"1229\" height=\"627\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3cfb1d9a-5a23-476c-86cc-f9a7de6bbe32\" />\n<img width=\"1140\" height=\"764\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2657e44f-3724-4136-a53f-75068945aef0\" />\n\n4. The JavaScript payload executes afted open URL.\n<img width=\"701\" height=\"809\" alt=\"image\" src=\"https://github.com/user-attachments/assets/343ad67a-e236-466b-9ec9-e4f1dea4fd5e\" />\n<img width=\"1382\" height=\"847\" alt=\"image\" src=\"https://github.com/user-attachments/assets/01820d3c-c374-402a-8d72-6ea75dbd92c2\" />\n\n### Impact\nArbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like < or > in icon text.\n\n### Note\nTested version:\n<img width=\"1368\" height=\"699\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a7466b8f-a88b-461d-8d9e-7178af7ab076\" />",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/siyuan-note/siyuan/kernel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260118021606-5c0cc375b475"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w836-5gpm-7r93"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-23847"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/issues/16844"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/commit/5c0cc375b47567e15edd2119066b09bb0aa18777"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/siyuan-note/siyuan"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-21T01:00:44Z",
    "nvd_published_at" : "2026-01-19T20:15:49Z"
  }
}