{"id":"CVE-2026-29183","published":"2026-03-06T07:18:26Z","modified":"2026-03-06T16:05:18Z","title":"SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript…","vendor":"siyuan-note","product":"siyuan","tier":"tail","description":{"text":"SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint \"GET /api/icon/getDynamicIcon\" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00639,"percentile":0.5048,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f","tags":["x_refsource_CONFIRM"]}],"priority":{"score":21.6,"factors":[{"name":"EPSS percentile","points":10.1},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.51}]},"exploitSources":{"nuclei":[{"id":"CVE-2026-29183","name":"SiYuan Note - Cross-Site Scripting","severity":"medium","path":"http/cves/2026/CVE-2026-29183.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29183.yaml"}],"provenance":"source"},"vendorSlug":"siyuan-note","affectedVersions":[{"vendor":"siyuan-note","product":"siyuan","versions":["< 3.5.9"]}],"affected":[{"ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","vulnerableRanges":["<0.0.0-20260304034809-d68bd5a79391"],"patched":["0.0.0-20260304034809-d68bd5a79391"],"from":["GHSA-6865-qjcf-286f","GO-2026-4596"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-10023","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-siyuan-note-siyuan-cve-2026-29183","children":[{"from":"CVE-2026-29183","to":"CVE-2026-31807","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9).","from":"CVE.org","in":"CVE-2026-31807"},{"kind":"version-step","provenance":"source","package":"Go:github.com/siyuan-note/siyuan/kernel","fromFixed":"0.0.0-20260304034809-d68bd5a79391","toFixed":"0.0.0-20260310025236-297bd526708f","daysApart":4},{"kind":"similar","provenance":"machine","score":0.4,"basis":"same product + CWE + description similarity"}]},{"from":"CVE-2026-29183","to":"CVE-2026-31809","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This is a second bypass of the fix for CVE-2026-29183 (fixed in v3.5.9).","from":"CVE.org","in":"CVE-2026-31809"},{"kind":"version-step","provenance":"source","package":"Go:github.com/siyuan-note/siyuan/kernel","fromFixed":"0.0.0-20260304034809-d68bd5a79391","toFixed":"0.0.0-20260310025236-297bd526708f","daysApart":4}]},{"from":"CVE-2026-29183","to":"CVE-2026-32940","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-6865-qjcf-286f","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-4mx9-3c2h-hwhg","via":"reference","url":"https://github.com/advisories/GHSA-6865-qjcf-286f"},{"kind":"osv-related","provenance":"source","id":"GO-2026-4721","via":"reference","url":"https://github.com/advisories/GHSA-6865-qjcf-286f"},{"kind":"similar","provenance":"machine","score":0.4,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2026-23847","published":"2026-01-19","fixed":"0.0.0-20260118021606-5c0cc375b475","kev":false},{"cve":"CVE-2026-23850","published":"2026-01-19","fixed":"0.0.0-20260118092326-b2274baba2e1","kev":false},{"cve":"CVE-2026-23851","published":"2026-01-19","fixed":"0.0.0-20260118092521-f8f4b517077b","kev":false,"link":{"from":"CVE-2026-23851","to":"CVE-2026-29183","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/siyuan-note/siyuan/kernel","fromFixed":"0.0.0-20260118092521-f8f4b517077b","toFixed":"0.0.0-20260304034809-d68bd5a79391","daysApart":46}]}},{"cve":"CVE-2026-29183","published":"2026-03-06","fixed":"0.0.0-20260304034809-d68bd5a79391","kev":false},{"cve":"CVE-2026-31807","published":"2026-03-10","fixed":"0.0.0-20260310025236-297bd526708f","kev":false},{"cve":"CVE-2026-31809","published":"2026-03-10","fixed":"0.0.0-20260310025236-297bd526708f","kev":false},{"cve":"CVE-2026-33066","published":"2026-03-20","fixed":"0.0.0-20260314111550-b382f50e1880","kev":false}],"package":"Go:github.com/siyuan-note/siyuan/kernel"}}