Vulnetix
Try Vulnetix Request Demo
CVE-2026-23847 PUBLISHED CVSS 2.0999999046325684 LOW

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]

EPSS 0.04% · 12.8th percentile

Risk Scores

CVSS v4.0
2.0999999046325684
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
EPSS Score
0.04%
12.8th percentile

Affected Products

VendorProductVersions
github.comsiyuan-note/siyuan/kernel0, 0
siyuan-notesiyuan< 3.5.4, < 3.5.4
b3logsiyuan0, 0

Timeline

References

Open in Interactive Console →