SiYuan Note - Cross-Site Scripting
CVE-2026-29183
Verified
Description
Unauthenticated reflected cross-site scripting (XSS) vulnerability in all versions of SiYuan Note containing `/api/icon/getDynamicIcon` with unsafe `type=8` rendering logic. Attacker-controlled `content` is inserted directly into SVG output without proper sanitization. An attacker can execute arbitrary JavaScript in users' browsers when they visit a crafted malicious link.
Severity
Medium
CVSS Score
6.1
Exploit Probability
1%
Affected Product
siyuan
Published Date
March 31, 2026
Template Author
ritikchaddha
CVE-2026-29183.yaml
6.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2026-29183
CWE ID:
cwe-79
Remediation Steps
Upgrade to SiYuan version 3.5.9 or later, which properly sanitizes SVG content.