CVE-2026-29183: b3log Siyuan

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.

Affected products

• b3log Siyuan: before 3.5.9 (fixed in 3.5.9)

Published 2026-03-06. Last modified 2026-06-17.