Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-06 | 6 | Disclosure4General1Patch1 |
| 2026-03-07 | 1 | Disclosure1 |
| 2026-03-09 | 1 | Patch1 |
| 2026-03-11 | 1 | Disclosure1 |
| 2026-03-18 | 1 | Disclosure1 |
| 2026-03-23 | 1 | Disclosure1 |
| 2026-04-01 | 1 | Disclosure1 |
🚨 CVE-2026-29183 - medium 🚨 SiYuan Note - Cross-Site Scripting > Unauthenticated reflected cross-site scripting (XSS) vulnerability in all versions of... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-29183 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces a medium‑severity unauthenticated reflected XSS vulnerability (CVE‑2026‑29183) in all SiYuan Note versions and provides a link for further details.
A critical 9.3 CVSS reflected XSS flaw (CVE-2026-29183) in SiYuan's dynamic icon API lets attackers steal private notes via SVG injection. Update now. #SiYuan #CVE #CyberSecurity #XSS #InfoSec #Vulnerability #PatchAlert #AppSec #SVGInjection #ThreatIntel https://securityonline.info/critical-9-3-cvss-flaw-in-siyuan-lets-hackers-steal-private-notes-via-svg-injection/ https://t.co/Jdpzt9ilUE
Post summary
A critical 9.3 CVSS reflected XSS flaw in SiYuan’s dynamic icon API enables SVG injection to steal private notes; users should apply the pending update immediately.
The `SiYuan` application is susceptible to unauthenticated reflected XSS via SVG injection (CVE-2026-29183). This flaw allows client-side script execution. Review exposure. #XSS #infosec #WebSecurity https://www.pulsepatch.io/posts/cve-2026-29183-siyuan-svg-xss
Post summary
The SiYuan application suffers from an unauthenticated reflected XSS vulnerability via SVG injection (CVE-2026-29183) that permits client‑side script execution.
An SVG sanitization bypass (GHSA-4mx9-3c2h-hwhg) affects `SiYuan` due to an incomplete fix for CVE-2026-29183. This could lead to content injection. Monitor for official patches. #SiYuan #SVG #SecurityBypass https://www.pulsepatch.io/posts/siyuan-svg-sanitize-bypass-vulnerability
Post summary
The post announces an SVG sanitization bypass in SiYuan related to CVE-2026-29183, noting a potential content injection issue and urging users to watch for official patches.
CVE-2026-29183 (CVSS:9.3, CRITICAL) is Analyzed. SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability..https://nvd.nist.gov/vuln/detail/CVE-2026-29183 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post identifies CVE-2026-29183 as a critical unauthenticated reflected XSS affecting SiYuan versions prior to 3.5.9, referencing the NVD entry for further details.
CVE-2026-29183 — Reflected XSS in SiYuan enables code execution via SVG endpoint A critical vulnerability has been identified in SiYuan (≤ v3.5.8) involving the unauthenticated endpoint: GET /api/icon/getDynamicIcon The API generates SVG icons dynamically but fails to properly sanitize user-controlled input when type=8 is used. Because the response is returned with an image/svg+xml content type, modern browsers interpret the payload as an active document. Attack vector An attacker can craft a malicious URL embedding SVG/HTML event handlers (e.g., onerror) that execute arbitrary JavaScript in the SiYuan application origin when the link is opened. Observed exploitation chain • Initial access: crafted URL sent to a target user • Execution: browser renders malicious SVG payload • Context: JavaScript executes under SiYuan origin • Post-exploitation: authenticated API requests and workspace access Potential impact • Full account takeover within the SiYuan instance • Exfiltration of notes, documents, and stored workspace data • Potential pivot into connected environments via stolen session context Remediation Upgrade immediately to SiYuan v3.5.9 or later. If patching is delayed: • Avoid opening untrusted links referencing the SiYuan instance • Apply WAF filtering for malicious SVG/HTML event handler patterns targeting the endpoint Source: https://yazoul.net/advisory/cve/cve-2026-29183 #CyberSecurity #ThreatIntel #CVE #XSS
Post summary
The advisory discloses a reflected XSS flaw in SiYuan that permits code execution via a dynamic SVG endpoint, detailing the exploit chain and providing upgrade and mitigation recommendations.
CVE-2026-29183 SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET … https://www.cve.org/CVERecord?id=CVE-2026-29183
Post summary
The text announces a reflected XSS vulnerability in SiYuan’s dynamic icon API that can be triggered without authentication, but provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-29183 Unauthenticated Reflected XSS Vulnerability in SiYuan Knowledge M... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29183 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A brief alert announces CVE-2026-29183, an unauthenticated reflected XSS vulnerability in SiYuan Knowledge, with a link to a vulnerability details page but no further exploit or patch information.
[CVE-2026-29183: CRITICAL] Unauthenticated reflected XSS vulnerability fixed in SiYuan 3.5.9. Attackers could inject JavaScript via crafted URLs to exfiltrate data from logged-in users.#cve,CVE-2026-29183,#cybersecurity https://cvefind.com/CVE-2026-29183
Post summary
The post highlights a critical unauthenticated reflected XSS vulnerability in SiYuan, noting that it was fixed in version 3.5.9, but provides no evidence of active exploitation or PoC.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-29183 Intel Report: https://ift.tt/inPMy47
Post summary
The tweet merely cites CVE-2026-29183 and links to an Intel report without providing PoC, exploitation details, or mitigation information.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-29183 - SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution Intel Report: https://ift.tt/jOqaxfU
Post summary
The alert reports CVE-2026-29183 as an unauthenticated reflected SVG XSS in SiYuan’s `/api/icon/getDynamicIcon` endpoint that allows arbitrary JavaScript execution, without indicating exploitation or remediation details.
🔴 CVE-2026-29183 - Critical SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicI... https://www.thehackerwire.com/vulnerability/CVE-2026-29183/ https://t.co/CKluADhzjv
Post summary
An unauthenticated reflected XSS flaw (CVE-2026-29183) in SiYuan’s dynamic icon API has been disclosed; no PoC, exploit code, patch, or active exploitation information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | b3log | siyuan | - | - | - |