CVE-2026-23852: 
NixOS vulnerability analysis and mitigation

CVE-2026-23852 is a stored Cross-Site Scripting (XSS) vulnerability in SiYuan, a personal knowledge management system, that can escalate to Remote Code Execution (RCE) in desktop environments. It affects all SiYuan versions prior to 3.5.4 (≤v3.5.3) and was disclosed on January 18–19, 2026. The vulnerability allows an attacker to inject arbitrary HTML attributes into the icon attribute of a block via the /api/attr/setBlockAttrs API, which are later rendered unsanitized in the dynamic icon feature. It carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of user-controlled input in the icon attribute processed by the /api/attr/setBlockAttrs API endpoint (CWE-79: Stored XSS; CWE-94: Code Injection). The icon field value is stored with the block and later inserted into an HTML attribute context by the dynamic icon rendering function (unicode2Emoji in app/src/emoji/index.ts) without sanitization, allowing quote-breaking injection of arbitrary attributes such as onload. This vulnerability is a bypass of a prior fix for issue #15970, which constrained the UI path but left the same sink reachable via the backend API. In the desktop (Electron) environment, the injected JavaScript can invoke Node.js APIs (e.g., require('child_process').exec(...)) to achieve arbitrary command execution (GitHub Advisory, Patch Commit).

In web environments, successful exploitation enables stored XSS that executes attacker-controlled JavaScript in the browser context of any user who views the compromised block, enabling session hijacking, credential theft, and unauthorized actions. In the SiYuan desktop application (built on Electron), the XSS can be escalated to full RCE by leveraging Node.js/Electron APIs, allowing arbitrary command execution on the victim's system. The payload is persistent and affects all users who access the modified block, with high confidentiality, integrity, and availability impact (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a video demonstration and sample payloads for both XSS and RCE (GitHub Advisory). Exploitation requires no privileges but does require the attacker to reach the SiYuan API and user interaction (a victim viewing the affected block). There is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.00267 (low probability of near-term exploitation), and the vulnerability is not listed in the CISA KEV catalog (Red Hat CVE).

1. Reconnaissance: Identify a running SiYuan instance (default port 6806) accessible from the network. Determine a valid block ID that the attacker can modify.
2. Craft malicious payload: Prepare a JSON payload that injects a quote-breaking XSS string into the icon attribute, e.g.:

{
  "id": "<target-block-id>",
  "attrs": {
    "icon": "api/icon/getDynamicIcon\" onload=\"alert(document.domain)"
  }
}

3. Inject via API: Send a POST request to /api/attr/setBlockAttrs on the target SiYuan instance with the crafted payload:

POST /api/attr/setBlockAttrs HTTP/1.1
Host: localhost:6806
Content-Type: application/json

4. Trigger rendering: Wait for a victim user to open the SiYuan UI and navigate to the block containing the modified icon. The dynamic icon feature renders the stored value unsanitized, executing the injected onload handler.
5. Escalate to RCE (desktop): Replace the XSS payload with a Node.js command execution payload leveraging Electron APIs:

api/icon/getDynamicIcon" onload="require('child_process').exec('gnome-calculator', null)

This executes arbitrary system commands in the context of the desktop application (GitHub Advisory).

• Network: Unexpected POST requests to /api/attr/setBlockAttrs (port 6806) containing unusual icon attribute values with quote characters, onload, or other event handler strings; outbound connections from the SiYuan process to unknown external hosts.
• Logs: SiYuan API access logs showing POST requests to /api/attr/setBlockAttrs with icon values containing HTML attribute injection patterns (e.g., \", onload=, onerror=, require().
• File System: Unexpected files created or modified by the SiYuan process or its child processes; new scripts or executables in user directories spawned after block rendering.
• Process: Unusual child processes spawned by the SiYuan/Electron process (e.g., bash, sh, cmd.exe, calc.exe, gnome-calculator, curl, wget) indicating successful RCE escalation (GitHub Advisory).

Upgrade SiYuan to version 3.5.4 or later, which applies Lute.Sanitize() to the rendered icon HTML in app/src/emoji/index.ts for both dynamic icon and image-based icon paths (Patch Commit). For organizations unable to patch immediately, restrict network access to the SiYuan API (port 6806) to trusted hosts only, and implement WAF rules to detect and block suspicious attribute injection patterns in the icon parameter of /api/attr/setBlockAttrs. Review API access logs for any prior suspicious use of the setBlockAttrs endpoint with unusual icon values (GitHub Advisory).

The vulnerability was reported by security researcher 0xNayel and disclosed via GitHub's Security Advisory program on January 18, 2026. A Bluesky post from a CVE tracking account noted the disclosure, and the issue was picked up by security aggregators including Vulners, CIRCL, and infinitsec.net shortly after publication. Red Hat also tracked the CVE in their security database. Community reaction highlighted the significance of the bypass, as it circumvented a previously issued fix for the same class of vulnerability (#15970) (GitHub Advisory, Red Hat CVE).