SiYuan 存在存储型跨站脚本 (Stored XSS) / 远程代码执行 (RCE) 漏洞，通过 `setBlockAttrs` 图标属性

The primary impact of CVE-2026-23852 is the ability for an attacker to inject malicious HTML into the icon attribute of blocks within SiYuan. This injection occurs through the /api/attr/setBlockAttrs API, which is used to manage block attributes. The injected payload is then rendered in the dynamic icon feature without proper sanitization. In the desktop environment, this can be exploited to achieve remote code execution. The bypass of the previous fix for issue #15970 highlights the complexity of preventing XSS vulnerabilities in dynamic content rendering. An attacker could potentially steal user credentials, deface the application, or execute arbitrary code on the user's machine, depending on the privileges of the SiYuan process.

Users of SiYuan's desktop application are particularly at risk due to the potential for remote code execution. Individuals who rely on SiYuan for sensitive information or who share their knowledge base with others are also at increased risk, as an attacker could potentially steal credentials or deface the application. Shared hosting environments where multiple users share the same SiYuan instance are also vulnerable.

• linux / server: Monitor SiYuan's access logs for unusual requests to /api/attr/setBlockAttrs containing suspicious HTML attributes. Use journalctl -f -u siyuan to monitor for error messages related to attribute parsing or rendering. • generic web: Use curl to test the /api/attr/setBlockAttrs endpoint with a simple HTML payload (e.g., <script>alert(1)</script>) and observe the response for signs of XSS. • python: If you have access to the SiYuan source code, review the /api/attr/setBlockAttrs endpoint for proper input validation and output encoding of the icon attribute.

1. 2026-01-19Disclosure

   disclosure

1. 已保留2026-01-16
2. 发布日期2026-01-19
3. 修改日期2026-01-20
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-23852 is to upgrade SiYuan to version 3.5.4 or later, which includes a fix for the vulnerability. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the /api/attr/setBlockAttrs API to prevent the injection of malicious HTML. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting HTML attributes could also provide a temporary layer of protection. Regularly review and update SiYuan's security configuration to ensure best practices are followed. After upgrading, confirm the fix by attempting to inject a simple HTML payload via the /api/attr/setBlockAttrs API and verifying that it is properly sanitized.