https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 10:29:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266012 EUVD-2026-266012 https://cve.radiocsirt.org/vuln/euvd-2026-266012 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23847 <p>SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG &lt;text&gt; tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]</p> <p>SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG &lt;text&gt; tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23847 https://cve.radiocsirt.org/vuln/ghsa-w836-5gpm-7r93 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input. ### Details The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG &lt;text&gt; tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.</p> <p>### PoC Payload: `test&lt;/text&gt;&lt;script&gt;alert(window.origin)&lt;/script&gt;&lt;text&gt;`</p> <p>1. Open any note and click Change Icon -&gt; Dynamic (Text). &lt;img width=&#34;713&#34; height=&#34;373&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/8a4f5ec4-81d6-46cb-8872-841cb2188ed8&#34; /&gt;</p> <p>2. Change color and paste the payload into the Custom field and click on this icon. &lt;img width=&#34;935&#34; height=&#34;682&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/24d28fbd-a3ce-44f1-a5bb-2cc3f711faf5&#34; /&gt;</p> <p>3. Intercept and send the request or get path from devtools &lt;img width=&#34;1229&#34; height=&#34;627&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/3cfb1d9a-5a23-476c-86cc-f9a7de6bbe32&#34; /&gt; &lt;img width=&#34;1140&#34; height=&#34;764&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/2657e44f-3724-4136-a53f-75068945aef0&#34; /&gt;</p> <p>4. The JavaScript payload executes afted open URL. &lt;img width=&#34;701&#34; height=&#34;809&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/343ad67a-e236-466b-9ec9-e4f1dea4fd5e&#34; /&gt; &lt;img width=&#34;1382&#34; height=&#34;847&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/01820d3c-c374-402a-8d72-6ea75db…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input. ### Details The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG &lt;text&gt; tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.</p> <p>### PoC Payload: `test&lt;/text&gt;&lt;script&gt;alert(window.origin)&lt;/script&gt;&lt;text&gt;`</p> <p>1. Open any note and click Change Icon -&gt; Dynamic (Text). &lt;img width=&#34;713&#34; height=&#34;373&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/8a4f5ec4-81d6-46cb-8872-841cb2188ed8&#34; /&gt;</p> <p>2. Change color and paste the payload into the Custom field and click on this icon. &lt;img width=&#34;935&#34; height=&#34;682&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/24d28fbd-a3ce-44f1-a5bb-2cc3f711faf5&#34; /&gt;</p> <p>3. Intercept and send the request or get path from devtools &lt;img width=&#34;1229&#34; height=&#34;627&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/3cfb1d9a-5a23-476c-86cc-f9a7de6bbe32&#34; /&gt; &lt;img width=&#34;1140&#34; height=&#34;764&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/2657e44f-3724-4136-a53f-75068945aef0&#34; /&gt;</p> <p>4. The JavaScript payload executes afted open URL. &lt;img width=&#34;701&#34; height=&#34;809&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/343ad67a-e236-466b-9ec9-e4f1dea4fd5e&#34; /&gt; &lt;img width=&#34;1382&#34; height=&#34;847&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/01820d3c-c374-402a-8d72-6ea75db…</p> https://cve.radiocsirt.org/vuln/ghsa-w836-5gpm-7r93