{"schema_version":"1.7.3","id":"GHSA-pcjq-j3mq-jv5j","published":"2026-01-16T19:22:08Z","modified":"2026-02-03T22:41:08.534097Z","aliases":["CVE-2026-23645","GO-2026-4324"],"summary":"SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload","details":"### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session.\n\n### Details\nThe application allows authenticated users to upload files, including .svg images, without sanitizing the input to remove embedded JavaScript code (such as <script> tags or event handlers).\n\n### PoC\n1. Create a new \"Daily note\" in the workspace.\n<img width=\"1287\" height=\"572\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3a4389b9-695d-4e1b-94dc-72efdb047aa9\" />\n2. Create a file named  test.svg with malicious JavaScript inside:\n\n```\n<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"200\" viewBox=\"0 0 124 124\" fill=\"none\">\n<rect width=\"124\" height=\"124\" rx=\"24\" fill=\"red\"/>\n   <script type=\"text/javascript\">  \n      alert(window.origin);\n   </script>\n</svg>\n```\n3. Upload a file in current daily note:\n<img width=\"1617\" height=\"316\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6e14318a-08ec-48e5-b278-9174ad17cfcb\" />\n<img width=\"1482\" height=\"739\" alt=\"image\" src=\"https://github.com/user-attachments/assets/95c996e8-5591-436a-9467-ab56c9ffbde0\" />\n<img width=\"1321\" height=\"548\" alt=\"image\" src=\"https://github.com/user-attachments/assets/249fb187-3caa-4372-a9c9-56dfda6b8a8f\" />\n4. Open the file:\n\n- Right-click the uploaded asset in the note.\n- Select \"Export\"\n<img width=\"934\" height=\"718\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ec943dfa-92ba-47f6-8b1e-56e53f1b0ca6\" />\n5. The JavaScript code executes immediately.\n<img width=\"1033\" height=\"632\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a1611291-d333-4f8e-9da9-62104aaa1bdd\" />\n<img width=\"1381\" height=\"641\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d5018203-dbd0-4285-8702-8cb3e7c5cd07\" />\n\n### Impact\nThe vulnerability allows  to upload an SVG file containing malicious scripts. When a user  exports this file, the embedded arbitrary JavaScript code is executed within their browser context\n\n###  Notes\nTested  version: \n<img width=\"1440\" height=\"534\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a62271e4-6850-4f59-be88-c4f8055429c0\" />\n\n### Solution\n\nhttps://github.com/siyuan-note/siyuan/issues/16844","affected":[{"package":{"name":"github.com/siyuan-note/siyuan/kernel","ecosystem":"Go","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260116101155-11115da3d0de"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-pcjq-j3mq-jv5j/GHSA-pcjq-j3mq-jv5j.json"}}],"references":[{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23645"},{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/issues/16844"},{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-01-16T19:22:08Z","nvd_published_at":"2026-01-16T20:15:49Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}