SiYuan, Reflected Cross-Site Scripting (XSS), Low severity

Listen to this Post

🐢▶️ Listen🚀

The vulnerability is a reflected cross-site scripting (XSS) in the `/api/icon/getDynamicIcon` endpoint of SiYuan note-taking software. This endpoint generates dynamic SVG icons for text (type=8). It takes a `content` query parameter and inserts its value directly into an SVG `` tag without performing XML escaping. The HTTP response has a `Content-Type: image/svg+xml` header, instructing browsers to parse the output as XML. An attacker can craft a malicious URL where the `content` parameter contains unescaped XML tags, such as </text><script>alert(window.origin)</script><text>. This payload closes the original `` element, injects a malicious `"

Check response Content-Type.

grep -r "getDynamicIcon" siyuan-code/

How Exploit:

Craft malicious URL.

Phish user visit.

Script executes automatically.

Protection from this CVE:

Update software version.

Escape XML input.

Validate user input.

Impact:

Arbitrary JavaScript execution.

Session hijacking possible.

Data theft risk.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin