Most recent entries from all

EUVD-2026-274766

2026-10-23T03:10:02.889920+00:00

EUVD-2026-274766

fkie_cve-2026-29183

2026-10-23T03:10:02.889958+00:00

SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.

GHSA-6865-qjcf-286f — SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint

2026-10-23T03:10:02.890013+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary An unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint:

- `GET /api/icon/getDynamicIcon`

When `type=8`, attacker-controlled `content` is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns `image/svg+xml`, a crafted URL can inject executable SVG/HTML event handlers (for example `onerror`) and run JavaScript in the SiYuan web origin.

This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link.

### Details The issue is caused by unsafe output construction and incomplete sanitization:

1. **Endpoint is exposed without auth middleware** - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/router.go#L27-L37 - `GET /api/icon/getDynamicIcon` is registered in the unauthenticated section.

2. **User input is inserted into SVG via string formatting** - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L115-L175 - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L537-L585 - In `generateTypeEightSVG`, `%s` directly injects `content` into `...` without XML/HTML escaping.

3. **Sanitizer only removes `