What is the CVSS score of CVE-2026-29183?

CVE-2026-29183 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Siyuan are affected by CVE-2026-29183?

A critical vulnerability in SiYuan knowledge management systems allows attackers to execute malicious code in users' browsers without authentication, potentially compromising sensitive organizational…. A patch is available.

Is there a public PoC exploit available for CVE-2026-29183?

Yes, a public proof-of-concept exploit is available for CVE-2026-29183. Prioritise patching immediately. EPSS: 0.0%.

Siyuan CVE-2026-29183

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-06 security-advisories@github.com

GHSA-6865-qjcf-286f

XSS Siyuan Suse

9.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 10, 2026 - 19:02 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 08:16 nvd

CRITICAL 9.3

DescriptionNVD

SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.

AnalysisAI

Reflected XSS in SiYuan knowledge management before 3.5.9.

RemediationAI

Within 24 hours: Identify all SiYuan deployments and their versions; assess exposure by determining internet accessibility and user count. Within 7 days: Implement WAF rules to block requests to /api/icon/getDynamicIcon with type=8 parameter; restrict API access to authenticated users only through network controls if feasible. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-9256 HIGH This Week

8.1 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers

Vendor StatusVendor

CVE-2026-29183 vulnerability details – vuln.today

Back