PT-2026-23102 · Siyuan · Siyuan

Maru1009 · Published 2026-03-04 · Updated 2026-04-01 · CVE-2026-29183

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SiYuan versions prior to 3.5.9

Description: SiYuan, a personal knowledge management system, contains an unauthenticated reflected cross-site scripting (XSS) vulnerability in the dynamic icon API endpoint 'GET /api/icon/getDynamicIcon' when type=8. Attacker-controlled content is embedded into SVG output without proper escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (e.g., onerror) and execute JavaScript within the SiYuan web origin. This can potentially lead to authenticated API actions and data exfiltration from logged-in users who open the malicious link. The vulnerability is due to unsafe output construction and incomplete sanitization, specifically the lack of escaping when inserting user-controlled content into SVG output. The API endpoint does not require authentication, and the response is served as image/svg+xml, allowing browsers to interpret the payload as an active document.

Recommendations: Upgrade to SiYuan version 3.5.9 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-29183

GHSA-6865-QJCF-286F

GO-2026-4596

SUSE-SU-2026:1042-1

Affected Products

Siyuan

References · 146

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29183.json · Exploit
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29183 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4596 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6865-qjcf-286f · Vendor Advisory
• https://github.com/siyuan-note/siyuan · Note
• https://github.com/siyuan-note/siyuan/commit/d68bd5a79391742b3cb2e14d892bdd9997064927 · Note
• https://twitter.com/TheHackerWire/status/2029835096778486166 · Twitter Post
• https://suse.com/security/cve/CVE-2026-29042 · Note
• https://suse.com/security/cve/CVE-2026-28268 · Note
• https://suse.com/security/cve/CVE-2026-28279 · Note
• https://suse.com/security/cve/CVE-2026-28512 · Note
• https://suse.com/security/cve/CVE-2026-29773 · Note