CVE-2026-23852
📋 TL;DR
SiYuan personal knowledge management systems before version 3.5.4 have a stored XSS vulnerability in the dynamic icon feature. Attackers can inject malicious HTML attributes via the /api/attr/setBlockAttrs API, leading to stored XSS and potential remote code execution in desktop environments. All users running vulnerable versions are affected.
💻 Affected Systems
- SiYuan Personal Knowledge Management System
📦 What is this software?
Siyuan by B3log
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on desktop clients, allowing full system compromise and data theft.
Likely Case
Stored XSS leading to session hijacking, credential theft, and unauthorized data access.
If Mitigated
Limited to stored XSS with proper input validation and output encoding in place.
🎯 Exploit Status
Exploitation requires API access but follows predictable patterns from previous similar vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.4
Vendor Advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7c6g-g2hx-23vv
Restart Required: Yes
Instructions:
1. Backup your data. 2. Download SiYuan 3.5.4 or later from official sources. 3. Install the update. 4. Restart the application.
🔧 Temporary Workarounds
Disable Dynamic Icons
allTemporarily disable the dynamic icon feature to prevent exploitation.
Restrict API Access
allLimit access to the /api/attr/setBlockAttrs endpoint to trusted users only.
🧯 If You Can't Patch
- Isolate SiYuan instances from critical systems and internet access.
- Implement strict input validation and output encoding for all user-controlled data.
🔍 How to Verify
Check if Vulnerable:
Check SiYuan version in application settings or about dialog.Check Version:
Check Help → About in SiYuan interfaceVerify Fix Applied:
Verify version is 3.5.4 or later and test dynamic icon functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to /api/attr/setBlockAttrs
- Suspicious HTML/JavaScript in icon attributes
Network Indicators:
- Malformed requests to SiYuan API endpoints
- Unexpected external resource loads from icon rendering
SIEM Query:
source="siyuan" AND (uri_path="/api/attr/setBlockAttrs" OR message="icon" AND (message="javascript:" OR message="onerror=" OR message="onload="))