CVE-2026-23852 SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute
Attackers can inject malicious HTML into block icons via API, causing stored XSS and potential remote code execution in the desktop application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-23852?
CVE-2026-23852 is a medium-severity cross-site scripting vulnerability in B3log Siyuan, published on 19 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject arbitrary HTML attributes into the `icon` attribute of a block via the `/api/attr/setBlockAttrs` API. The payload is later rendered in the dynamic icon feature in an unsanitized context, leading to stored XSS and, in the desktop environment, potential remote code execution (RCE). This issue bypasses the previous fix for issue `#15970` (XSS → RCE via dynamic icons). Version 3.5.4 contains an updated fix.
Which versions are affected by CVE-2026-23852?
It affects 1 product.
Products include B3log Siyuan.
How do I fix CVE-2026-23852?
No fix has been published for CVE-2026-23852 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-23852 being exploited?
There is no known exploitation of CVE-2026-23852 in the wild and no public exploit code.
Other vulnerabilities in B3log Siyuan
- CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service
- CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33670 SiYuan has directory traversal within its publishing service
- CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
- CVE-2024-53504 SQL injection in n/a
Sources
Also known as GHSA-7c6g-g2hx-23vv.