Go/github.com/siyuan-note/siyuan/kernel CVE-2026-23847: medium 6.1, EPSS 0.31%

SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel

Action: Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260118021606-5c0cc375b475 or later.

go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260118021606-5c0cc375b475

Affected

Fixed versions

Sources

• osv: GO-2026-4343
• nvd: CVE-2026-23847
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w836-5gpm-7r93
• https://github.com/siyuan-note/siyuan/commit/5c0cc375b47567e15edd2119066b09bb0aa18777
• https://github.com/siyuan-note/siyuan/issues/16844

CVE-2026-23847 · published 2026-02-03T20:37:17Z · modified 2026-03-03T04:57:54.033188Z · JSON