CVE-2026-23847: SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

January 21, 2026

Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input.

References

github.com/advisories/GHSA-w836-5gpm-7r93
github.com/siyuan-note/siyuan
github.com/siyuan-note/siyuan/commit/5c0cc375b47567e15edd2119066b09bb0aa18777
github.com/siyuan-note/siyuan/issues/16844
github.com/siyuan-note/siyuan/security/advisories/GHSA-w836-5gpm-7r93
nvd.nist.gov/vuln/detail/CVE-2026-23847

Code Behaviors & Features

Detect and mitigate CVE-2026-23847 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →