Platform
go
Component
github.com/siyuan-note/siyuan/kernel
Fixed in
3.5.10
0.0.0-20260304034809-d68bd5a79391
CVE-2026-29183 describes a reflected Cross-Site Scripting (XSS) vulnerability within the SiYuan Kernel, specifically in its dynamic icon API endpoint (/api/icon/getDynamicIcon). This vulnerability allows an unauthenticated attacker to inject malicious code, potentially leading to data exfiltration and unauthorized actions. The vulnerability impacts versions of SiYuan Kernel prior to 0.0.0-20260304034809-d68bd5a79391, and a patch has been released to address the issue.
The XSS vulnerability in SiYuan Kernel’s dynamic icon API is particularly concerning due to its unauthenticated nature. An attacker can craft a malicious URL containing attacker-controlled content within the type=8 parameter. This content is then embedded into the SVG output without proper escaping, allowing the injection of executable SVG/HTML event handlers, such as onerror. Successful exploitation allows the attacker to execute JavaScript within the SiYuan web origin. This can be leveraged to steal sensitive data, impersonate legitimate users, or perform other malicious actions, especially if the victim is a logged-in user who clicks the malicious link. The potential for data exfiltration and account takeover makes this a high-impact vulnerability.
CVE-2026-29183 was publicly disclosed on March 4, 2026. The vulnerability's unauthenticated nature and ease of exploitation suggest a potential for widespread exploitation. While no public proof-of-concept (PoC) has been observed as of the disclosure date, the simplicity of the attack vector makes it likely that PoCs will emerge. The vulnerability is not currently listed on CISA KEV, but its criticality warrants close monitoring. Active campaigns targeting SiYuan users are not currently confirmed, but the risk remains elevated.
Exploit Status
EPSS
0.01% (1% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-29183 is to immediately upgrade SiYuan Kernel to version 0.0.0-20260304034809-d68bd5a79391 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Input validation and output encoding on the /api/icon/getDynamicIcon endpoint are crucial. Web Application Firewalls (WAFs) can be configured to detect and block requests containing suspicious SVG content or event handlers. Monitor SiYuan logs for unusual activity, particularly requests to the /api/icon/getDynamicIcon endpoint with unusual parameters. After upgrading, confirm the fix by attempting to trigger the vulnerability with a crafted URL and verifying that the SVG output is properly sanitized and does not execute malicious code.
Actualice SiYuan a la versión 3.5.9 o superior. Esta versión corrige la vulnerabilidad XSS reflejada en el endpoint `/api/icon/getDynamicIcon` con `type=8`. La actualización evitará la ejecución de JavaScript arbitrario al abrir enlaces maliciosos.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-29183 is a critical XSS vulnerability in SiYuan Kernel's dynamic icon API, allowing unauthenticated attackers to inject malicious code.
You are affected if you are using a version of SiYuan Kernel prior to 0.0.0-20260304034809-d68bd5a79391.
Upgrade SiYuan Kernel to version 0.0.0-20260304034809-d68bd5a79391 or later. Implement input validation and output encoding as a temporary workaround.
Active exploitation is not currently confirmed, but the vulnerability's ease of exploitation suggests a potential for widespread attacks.
Refer to the official SiYuan project website and security advisories for the latest information and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your go.mod file and we'll tell you instantly if you're affected.