VDB

CVE-2026-23847

CVE-2026-23847 PUBLISHED CVSS 2.0999999046325684 LOW

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]

EPSS 0.07% · 20.4th percentile

Risk Scores

CVSS 4.0
2.0999999046325684
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
EPSS Score
0.07%
20.4th percentile

Affected Products

VendorProductVersions
github.comsiyuan-note/siyuan/kernel0, 0
siyuan-notesiyuan< 3.5.4, < 3.5.4
b3logsiyuan0, 0

Timeline

  • Jan 19, 2026 CVE Published
  • Jan 19, 2026 PoC Published
  • Jan 20, 2026 EPSS Score
  • Jan 20, 2026 CVE Updated
  • Jan 23, 2026 EPSS Score
  • Jan 24, 2026 PoC Published
  • Jan 26, 2026 EPSS Score
  • Jan 28, 2026 EPSS Score
  • Jan 30, 2026 Security Advisory
  • Jan 31, 2026 EPSS Score
  • Feb 3, 2026 EPSS Score
  • Feb 6, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›