GHSA-w836-5gpm-7r93 SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

• Go github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260118021606-5c0cc375b475 → fixed in 0.0.0-20260118021606-5c0cc375b475

Summary Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input. Details The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. PoC Payload: `testalert(window.origin)` 1. Open any note and click Change Icon -> Dynamic (Text). 2. Change color and paste the payload into the Custom field and click on this icon. 3. Intercept and send the request or get path from devtools 4. The JavaScript payload executes afted open URL. Impact Arbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like in icon text. Note Tested version: