Skip to content

Commit 42007bd

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6865-qjcf-286f GHSA-f4vq-pj32-gr4q GHSA-f4vq-pj32-gr4q
1 parent 479c858 commit 42007bd

3 files changed

Lines changed: 130 additions & 40 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-6865-qjcf-286f/GHSA-6865-qjcf-286f.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6865-qjcf-286f",
4+
"modified": "2026-03-04T21:45:10Z",
5+
"published": "2026-03-04T21:45:10Z",
6+
"aliases": [
7+
"CVE-2026-29183"
8+
],
9+
"summary": "SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint",
10+
"details": "### Summary\nAn unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint:\n\n- `GET /api/icon/getDynamicIcon`\n\nWhen `type=8`, attacker-controlled `content` is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns `image/svg+xml`, a crafted URL can inject executable SVG/HTML event handlers (for example `onerror`) and run JavaScript in the SiYuan web origin.\n\nThis can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link.\n\n### Details\nThe issue is caused by unsafe output construction and incomplete sanitization:\n\n1. **Endpoint is exposed without auth middleware**\n - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/router.go#L27-L37\n - `GET /api/icon/getDynamicIcon` is registered in the unauthenticated section.\n\n2. **User input is inserted into SVG via string formatting**\n - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L115-L175\n - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L537-L585\n - In `generateTypeEightSVG`, `%s` directly injects `content` into `<text>...</text>` without XML/HTML escaping.\n\n3. **Sanitizer only removes `<script>` tags**\n - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/util/misc.go#L235-L281\n - `RemoveScriptsInSVG` removes `<script>` nodes, but does not remove dangerous attributes (`onerror`, `onload`, etc.) or unsafe elements.\n\nAs a result, payloads such as `</text><image ... onerror=...><text>` survive and execute.\n\n### PoC\n\n#### Minimal browser execution PoC\nOpen this URL in a browser:\n\n```http\nGET /api/icon/getDynamicIcon?type=8&content=%3C%2Ftext%3E%3Cimage%20href%3Dx%20onerror%3Dalert(document.domain)%3E%3C%2Fimage%3E%3Ctext%3E\n```\n\nExample full URL:\n\n```text\nhttp://127.0.0.1:6806/api/icon/getDynamicIcon?type=8&content=%3C%2Ftext%3E%3Cimage%20href%3Dx%20onerror%3Dalert(document.domain)%3E%3C%2Fimage%3E%3Ctext%3E\n```\n\nExpected result:\n\n- JavaScript executes (`alert(document.domain)`), confirming reflected XSS.\n\n#### Authenticated impact demonstration\nIf a victim is authenticated in the same browser session, JavaScript running in origin can call privileged APIs and exfiltrate returned data.\n\n### Impact\nThis is a reflected XSS in an unauthenticated endpoint, with realistic account/data compromise impact:\n\n- Arbitrary JavaScript execution in SiYuan web origin.\n- Authenticated action abuse via same-origin API calls.\n- Sensitive data exposure (notes/config/API responses) from victim context.\n- Potential chained server-impact actions depending on victim privileges and deployment mode.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/siyuan-note/siyuan/kernel"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.0.0-20260304034809-d68bd5a79391"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/siyuan-note/siyuan/commit/d68bd5a79391742b3cb2e14d892bdd9997064927"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/siyuan-note/siyuan"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-79"
55+
],
56+
"severity": "CRITICAL",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-04T21:45:10Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-f4vq-pj32-gr4q/GHSA-f4vq-pj32-gr4q.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f4vq-pj32-gr4q",
4+
"modified": "2026-03-04T21:46:00Z",
5+
"published": "2026-03-04T03:31:34Z",
6+
"aliases": [
7+
"CVE-2026-3241"
8+
],
9+
"summary": "Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability",
10+
"details": "In Concrete CMS below version 9.4.8, a Cross-site Scripting (XSS) vulnerability exists in the \"Legacy Form\" block. An authenticated user with permissions to create or edit forms (e.g., a rogue administrator) can inject a persistent JavaScript payload into the options of a multiple-choice question (Checkbox List, Radio Buttons, or Select Box). This payload is then executed in the browser of any user who views the page containing the form. \n\nThe Concrete CMS security team thanks M3dium for reporting.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "Packagist",
25+
"name": "concrete5/concrete5"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "9.4.8"
36+
}
37+
]
38+
}
39+
]
40+
}
41+
],
42+
"references": [
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3241"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/concretecms/concretecms/pull/12826"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/concretecms/concretecms"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-79"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-03-04T21:46:00Z",
67+
"nvd_published_at": "2026-03-04T03:16:05Z"
68+
}
69+
}

‎advisories/unreviewed/2026/03/GHSA-f4vq-pj32-gr4q/GHSA-f4vq-pj32-gr4q.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

0 commit comments

Comments
 (0)