GHSA-w836-5gpm-7r93

Source

https://github.com/advisories/GHSA-w836-5gpm-7r93

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-w836-5gpm-7r93/GHSA-w836-5gpm-7r93.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-w836-5gpm-7r93

Aliases

Published

2026-01-21T01:00:44Z

Modified

2026-02-03T22:41:16Z

Severity

4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator

Summary

SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

Details

Summary

Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input.

Details

The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.

PoC

Payload: test</text><script>alert(window.origin)</script><text>

Open any note and click Change Icon -> Dynamic (Text).
Change color and paste the payload into the Custom field and click on this icon.
Intercept and send the request or get path from devtools
The JavaScript payload executes afted open URL.

Impact

Arbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like < or > in icon text.

Note

Tested version:

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-21T01:00:44Z",
    "nvd_published_at":  "2026-01-19T20:15:49Z",
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/siyuan-note/siyuan/kernel

Package

Name: github.com/siyuan-note/siyuan/kernel; View open source insights on deps.dev
Purl: pkg:golang/github.com/siyuan-note/siyuan/kernel

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20260118021606-5c0cc375b475

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-w836-5gpm-7r93/GHSA-w836-5gpm-7r93.json"