CVE-2026-23847
Medium
Description
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]
SeverityMedium
CVSS6.1
Exploit probability—
ProductB3log Siyuan
PublishedJan 19, 2026
First seenJan 19, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- b3log siyuan3.5.4 or later
- github.com/siyuan-note/siyuan/kernel0.0.0-20260118021606-5c0cc375b475 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| b3log siyuan | v < 3.5.4 | 3.5.4 |
| github.com/siyuan-note/siyuan/kernelGo | v < 0.0.0-20260118021606-5c0cc375b475 | 0.0.0-20260118021606-5c0cc375b475 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.