CVE-2026-29183 - Vulnerability Analysis

Overview

SiYuan < 3.5.9 contains an unauthenticated reflected XSS caused by improper escaping of attacker-controlled content in the dynamic icon API endpoint GET /api/icon/getDynamicIcon with type=8, letting remote attackers execute JavaScript in the web origin, exploit requires victim to open crafted URL.

Severity & Score

Impact

Attackers can execute JavaScript in the victim's browser, potentially leading to data exfiltration and unauthorized API actions.

Mitigation

Update to version 3.5.9 or later.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner