CNNVD-202601-2998 Information
CNNVD ID
CNNVD-202601-2998
Related CVE
- CNNVD Published: 2026-01-19
Description (Chinese)
SiYuan是SiYuan开源的一个隐私至上的个人知识管理系统。 SiYuan 3.5.4之前版本存在跨站脚本漏洞，该漏洞源于/api/icon/getDynamicIcon端点对未清理的SVG输入处理不当，可能导致反射型跨站脚本攻击。
Description (English)
SiYuan is an open-source, private, personal knowledge management system. The pre-SiYuan 3.5.4 version had a cross-site script loophole, which originated from/api/icon/getDynamicIcon endpoint mishandling of the uncleaned SVG input, which could lead to a cross-reflective script attack.
Hazard Level
High
Vulnerability Type
跨站脚本
Affected Vendor
SiYuan
Published
2026-01-19
Last Modified
2026-02-24
References
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w836-5gpm-7r93 https://github.com/siyuan-note/siyuan/issues/16844 https://github.com/siyuan-note/siyuan/commit/5c0cc375b47567e15edd2119066b09bb0aa18777 https://access.redhat.com/security/cve/cve-2026-23847
Patch
https://github.com/siyuan-note/siyuan/releases
Share on: