2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23847

CVE-2026-23847: SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23847

CVE-2026-23847:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/siyuan-note/siyuan/kernel	go	< 0.0.0-20260118021606-5c0cc375b475	0.0.0-20260118021606-5c0cc375b475

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security advisory describes a reflected Cross-Site Scripting (XSS) vulnerability in the /api/icon/getDynamicIcon endpoint of SiYuan. The vulnerability exists because the content query parameter is not properly sanitized before being embedded in an SVG response. The provided commit 5c0cc375b47567e15edd2119066b09bb0aa18777 directly addresses this issue. The commit modifies the kernel/api/icon.go file, specifically within the getDynamicIcon function. The patch introduces a sanitization step by calling util.RemoveScriptsInSVG(svg) before the SVG is sent in the HTTP response. This confirms that getDynamicIcon is the function where the vulnerability existed. An attacker could exploit this by crafting a URL with a malicious payload in the content parameter, which, when visited by a victim, would execute arbitrary JavaScript in their browser.

Vulnerable functions

getDynamicIcon

kernel/api/icon.go

The `getDynamicIcon` function is responsible for generating dynamic icons as SVG images. It takes user input, including a 'content' parameter, and embeds it within the SVG. Before the patch, this input was not sanitized, allowing an attacker to inject malicious scripts into the SVG. When a user views the icon, the script would execute in their browser context. The patch introduces a call to `util.RemoveScriptsInSVG` to strip out any scripts before the SVG is returned, thus mitigating the XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.