https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-24T10:29:39.164690+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-266012 EUVD-2026-266012 2026-10-24T10:29:39.166870+00:00 EUVD-2026-266012 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23847 fkie_cve-2026-23847 2026-10-24T10:29:39.166909+00:00

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]

 https://cve.radiocsirt.org/vuln/ghsa-w836-5gpm-7r93 GHSA-w836-5gpm-7r93 — SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon 2026-10-24T10:29:39.166955+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input. ### Details The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.

### PoC Payload: `test</text><script>alert(window.origin)</script><text>`

1. Open any note and click Change Icon -> Dynamic (Text). <img width="713" height="373" alt="image" src="https://github.com/user-attachments/assets/8a4f5ec4-81d6-46cb-8872-841cb2188ed8" />

2. Change color and paste the payload into the Custom field and click on this icon. <img width="935" height="682" alt="image" src="https://github.com/user-attachments/assets/24d28fbd-a3ce-44f1-a5bb-2cc3f711faf5" />

3. Intercept and send the request or get path from devtools <img width="1229" height="627" alt="image" src="https://github.com/user-attachments/assets/3cfb1d9a-5a23-476c-86cc-f9a7de6bbe32" /> <img width="1140" height="764" alt="image" src="https://github.com/user-attachments/assets/2657e44f-3724-4136-a53f-75068945aef0" />

4. The JavaScript payload executes afted open URL. <img width="701" height="809" alt="image" src="https://github.com/user-attachments/assets/343ad67a-e236-466b-9ec9-e4f1dea4fd5e" /> <img width="1382" height="847" alt="image" src="https://github.com/user-attachments/assets/01820d3c-c374-402a-8d72-6ea75db…