Summary
An unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint:
GET /api/icon/getDynamicIcon
When type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin.
This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link.
Details
The issue is caused by unsafe output construction and incomplete sanitization:
-
Endpoint is exposed without auth middleware
-
User input is inserted into SVG via string formatting
-
Sanitizer only removes <script> tags
As a result, payloads such as </text><image ... onerror=...><text> survive and execute.
PoC
Minimal browser execution PoC
Open this URL in a browser:
GET /api/icon/getDynamicIcon?type=8&content=%3C%2Ftext%3E%3Cimage%20href%3Dx%20onerror%3Dalert(document.domain)%3E%3C%2Fimage%3E%3Ctext%3E
Example full URL:
http://127.0.0.1:6806/api/icon/getDynamicIcon?type=8&content=%3C%2Ftext%3E%3Cimage%20href%3Dx%20onerror%3Dalert(document.domain)%3E%3C%2Fimage%3E%3Ctext%3E
Expected result:
- JavaScript executes (
alert(document.domain)), confirming reflected XSS.
Authenticated impact demonstration
If a victim is authenticated in the same browser session, JavaScript running in origin can call privileged APIs and exfiltrate returned data.
Impact
This is a reflected XSS in an unauthenticated endpoint, with realistic account/data compromise impact:
- Arbitrary JavaScript execution in SiYuan web origin.
- Authenticated action abuse via same-origin API calls.
- Sensitive data exposure (notes/config/API responses) from victim context.
- Potential chained server-impact actions depending on victim privileges and deployment mode.
References
maru1009 Reporter
Summary
An unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint:
GET /api/icon/getDynamicIconWhen
type=8, attacker-controlledcontentis embedded into SVG output without escaping. Because the endpoint is unauthenticated and returnsimage/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for exampleonerror) and run JavaScript in the SiYuan web origin.This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link.
Details
The issue is caused by unsafe output construction and incomplete sanitization:
Endpoint is exposed without auth middleware
GET /api/icon/getDynamicIconis registered in the unauthenticated section.User input is inserted into SVG via string formatting
generateTypeEightSVG,%sdirectly injectscontentinto<text>...</text>without XML/HTML escaping.Sanitizer only removes
<script>tagsRemoveScriptsInSVGremoves<script>nodes, but does not remove dangerous attributes (onerror,onload, etc.) or unsafe elements.As a result, payloads such as
</text><image ... onerror=...><text>survive and execute.PoC
Minimal browser execution PoC
Open this URL in a browser:
Example full URL:
Expected result:
alert(document.domain)), confirming reflected XSS.Authenticated impact demonstration
If a victim is authenticated in the same browser session, JavaScript running in origin can call privileged APIs and exfiltrate returned data.
Impact
This is a reflected XSS in an unauthenticated endpoint, with realistic account/data compromise impact:
References