CVE-2026-29183

🗓️ 06 Mar 2026 07:18:26Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 26 Views🌐 WEB

Unauthenticated reflected SVG in getDynamicIcon type 8 enables JavaScript execution; fixed in version 3.5.9.

Reporter	Title	Published	Views	Family All 134
ATTACKERKB	CVE-2026-31807	10 Mar 202620:56	–	attackerkb
ATTACKERKB	CVE-2026-31809	10 Mar 202620:58	–	attackerkb
ATTACKERKB	CVE-2026-29183	6 Mar 202607:18	–	attackerkb
Circl	CVE-2026-29183	4 Mar 202603:48	–	circl
CNNVD	SiYuan 跨站脚本漏洞	6 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-29183 SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution	6 Mar 202607:18	–	cvelist
Github Security Blog	SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)	17 Mar 202614:08	–	github
Github Security Blog	SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint	4 Mar 202621:45	–	github
Nuclei	SiYuan Note - Cross-Site Scripting	23 Jun 202605:08	–	nuclei
NVD	CVE-2026-29183	6 Mar 202608:16	–	nvd

NVD

Vulners

Node

b3log siyuanRange<3.5.9

[
  {
    "vendor": "siyuan-note",
    "product": "siyuan",
    "versions": [
      {
        "version": "< 3.5.9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f

Parameter	Position	Path	Description	CWE
type	query param	/api/icon/getDynamicIcon	Unauthenticated reflected XSS via dynamic icon endpoint when type=8 injecting into SVG output that can execute script in the web origin.	CWE-79

17 Jun 2026 10:29Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.1 - 9.3

EPSS0.00625

SSVC

CWE-79