https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 03:09:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274766 EUVD-2026-274766 https://cve.radiocsirt.org/vuln/euvd-2026-274766 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29183 <p>SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint &#34;GET /api/icon/getDynamicIcon&#34; when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.</p> <p>SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint &#34;GET /api/icon/getDynamicIcon&#34; when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29183 https://cve.radiocsirt.org/vuln/ghsa-6865-qjcf-286f <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary An unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint:</p> <p>- `GET /api/icon/getDynamicIcon`</p> <p>When `type=8`, attacker-controlled `content` is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns `image/svg+xml`, a crafted URL can inject executable SVG/HTML event handlers (for example `onerror`) and run JavaScript in the SiYuan web origin.</p> <p>This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link.</p> <p>### Details The issue is caused by unsafe output construction and incomplete sanitization:</p> <p>1. **Endpoint is exposed without auth middleware** - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/router.go#L27-L37 - `GET /api/icon/getDynamicIcon` is registered in the unauthenticated section.</p> <p>2. **User input is inserted into SVG via string formatting** - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L115-L175 - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L537-L585 - In `generateTypeEightSVG`, `%s` directly injects `content` into `&lt;text&gt;...&lt;/text&gt;` without XML/HTML escaping.</p> <p>3. **Sanitizer only removes `&lt;script&gt;` tags** - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/util/misc.go#L235-L281 - `RemoveScriptsInSVG` removes `&lt;script&gt;` nodes, but does not remove dangerous attributes (`onerror`, `onload`, etc.)…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary An unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint:</p> <p>- `GET /api/icon/getDynamicIcon`</p> <p>When `type=8`, attacker-controlled `content` is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns `image/svg+xml`, a crafted URL can inject executable SVG/HTML event handlers (for example `onerror`) and run JavaScript in the SiYuan web origin.</p> <p>This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link.</p> <p>### Details The issue is caused by unsafe output construction and incomplete sanitization:</p> <p>1. **Endpoint is exposed without auth middleware** - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/router.go#L27-L37 - `GET /api/icon/getDynamicIcon` is registered in the unauthenticated section.</p> <p>2. **User input is inserted into SVG via string formatting** - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L115-L175 - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L537-L585 - In `generateTypeEightSVG`, `%s` directly injects `content` into `&lt;text&gt;...&lt;/text&gt;` without XML/HTML escaping.</p> <p>3. **Sanitizer only removes `&lt;script&gt;` tags** - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/util/misc.go#L235-L281 - `RemoveScriptsInSVG` removes `&lt;script&gt;` nodes, but does not remove dangerous attributes (`onerror`, `onload`, etc.)…</p> https://cve.radiocsirt.org/vuln/ghsa-6865-qjcf-286f