Reflected Cross-Site Scripting Vulnerability in SiYuan Knowledge Management System
CVE-2026-23847

2.1LOW

Key Information:

Vendor: Siyuan-note
Status: Siyuan
Vendor: CVE Published:; 19 January 2026

🔔 Create Siyuan-note Vulnerability Alert

What is CVE-2026-23847?

The SiYuan Personal Knowledge Management System, prior to version 3.5.4, is susceptible to a reflected cross-site scripting vulnerability located in the /api/icon/getDynamicIcon endpoint. This flaw arises from the application’s failure to properly sanitize SVG input, specifically where the content query parameter is directly embedded into the SVG tag without appropriate XML escaping. As the server response is set to image/svg+xml, an attacker can exploit this vulnerability by injecting unescaped tags that compromise the XML structure, ultimately enabling the execution of arbitrary JavaScript. The issue was addressed in the 3.5.4 version released by SiYuan.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch