CVE-2026-29183: b3log siyuan Cross-site Scripting

Vulnerability summary

CVE-2026-29183 is a critical (CVSS 9.3) Cross-site Scripting vulnerability in b3log siyuan. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-03-2026
   PublishedVulnerability first disclosed.
2. 06-03-2026
   Last modifiedVulnerability information updated.

Description

SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.