`\n\n1. Open any note and click Change Icon -> Dynamic (Text).\n $\"image\"$ \n\n2. Change color and paste the payload into the Custom field and click on this icon.\n $\"image\"$ \n\n3. Intercept and send the request or get path from devtools \n $\"image\"$ \n $\"image\"$ \n\n4. The JavaScript payload executes afted open URL.\n $\"image\"$ \n $\"image\"$ \n\n### Impact\nArbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like < or > in icon text.\n\n### Note\nTested version:\n $\"image\"$ ","datePublished":"2026-01-26T08:05:57.138000","dateModified":"2026-01-26T10:50:08.422000","author":{"@type":"Organization","name":"Strobes Security","url":"https://strobes.co"},"publisher":{"@type":"Organization","name":"Strobes VI","url":"https://vi.strobes.co"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://vi.strobes.co/cve/CVE-2026-23847"},"about":{"@type":"Thing","name":"CVE-2026-23847","description":"Security vulnerability CVE-2026-23847 with CVSS score 0"},"keywords":["CVE-2026-23847","CVE","vulnerability","security","low","patch available"]}`\n\n1. Open any note and click Change Icon -> Dynamic (Text).\n $\"image\"$ \n\n2. Change color and paste the payload into the Custom field and click on this icon.\n $\"image\"$ \n\n3. Intercept and send the request or get path from devtools \n $\"image\"$ \n $\"image\"$ \n\n4. The JavaScript payload executes afted open URL.\n $\"image\"$ \n $\"image\"$ \n\n### Impact\nArbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like < or > in icon text.\n\n### Note\nTested version:\n $\"image\"$ "}},{"@type":"Question","name":"What is the severity of CVE-2026-23847?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-23847 has a CVSS v3 score of 0, which is classified as Low severity."}},{"@type":"Question","name":"Is there an exploit available for CVE-2026-23847?","acceptedAnswer":{"@type":"Answer","text":"No known public exploits are currently available for CVE-2026-23847."}},{"@type":"Question","name":"Is there a patch available for CVE-2026-23847?","acceptedAnswer":{"@type":"Answer","text":"Yes, patches are available for CVE-2026-23847. Check the vendor advisories for update instructions."}}]}

CVE-2026-23847

Published: January 26, 2026

Last updated:23 hours ago (January 26, 2026)

Exploit: NoZero-day: NoPatch: YesTrend: Neutral

TL;DR

Updated January 26, 2026

CVE-2026-23847 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.

Key Points

1Low severity (CVSS 0.0/10)
2No known public exploits
3Vendor patches are available

Severity Scores

CVSS v30.0

CVSS v20.0

Priority Score0.0

EPSS Score0.0

None

Exploitation LikelihoodMinimal

0.00%EPSS

Very low probability of exploitation

Monitor and patch as resources allow

0.00%

EPSS

0.0

CVSS

Exploit

Yes

Patch

Low Priority

no major risk factors

EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.

Description

Summary

Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input.

Details

The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript.

PoC

Payload: test</text><script>alert(window.origin)</script><text>

Open any note and click Change Icon -> Dynamic (Text).
<img width="713" height="373" alt="image" src="https://github.com/user-attachments/assets/8a4f5ec4-81d6-46cb-8872-841cb2188ed8" />
Change color and paste the payload into the Custom field and click on this icon.
<img width="935" height="682" alt="image" src="https://github.com/user-attachments/assets/24d28fbd-a3ce-44f1-a5bb-2cc3f711faf5" />
Intercept and send the request or get path from devtools
<img width="1229" height="627" alt="image" src="https://github.com/user-attachments/assets/3cfb1d9a-5a23-476c-86cc-f9a7de6bbe32" />

The JavaScript payload executes afted open URL. <img width="701" height="809" alt="image" src="https://github.com/user-attachments/assets/343ad67a-e236-466b-9ec9-e4f1dea4fd5e" />

Impact

Arbitrary JavaScript execution in the user's session context if the SVG is loaded directly. It also prevents using legitimate characters like < or > in icon text.

Note

Tested version: <img width="1368" height="699" alt="image" src="https://github.com/user-attachments/assets/a7466b8f-a88b-461d-8d9e-7178af7ab076" />

CVSS v3 Breakdown

Attack Vector:-

Attack Complexity:-

Privileges Required:-

User Interaction:-

Scope:-

Confidentiality:-

Integrity:-

Availability:-

Patch References

Github.com

Trend Analysis

Neutral

Advisories

GitHub Advisory NVD

Cite This Page

APA Format

Strobes VI. (2026). CVE-2026-23847 - CVE Details and Analysis. Strobes VI. Retrieved January 27, 2026, from https://vi.strobes.co/cve/CVE-2026-23847

Quick copy link + title

Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.