A vulnerability, which was classified as problematic, has been found in SiYuan up to 3.5.8. Affected by this issue is some unknown functionality of the file /api/icon/getDynamicIcon of the component API Endpoint. The manipulation leads to cross site scripting.
This vulnerability is uniquely identified as CVE-2026-29183. The attack is possible to be carried out remotely. No exploit exists.
It is advisable to upgrade the affected component.
