What’s Vulnerable › Vulnerabilities
CVE-2026-29183: SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-06 · updated 2026-06-17
- Weakness: CWE-79
Description
SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.
Affected products
- siyuan-note siyuan: before 3.5.9 — fixed in 3.5.9
How to fix
Upgrade to a fixed version: siyuan-note siyuan 3.5.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-29183 or the next vulnerability affects your stack