Reflected XSS in SiYuan dynamic icon API

Successful exploitation allows arbitrary JavaScript execution in the SiYuan web origin in the context of the victim user. Because the vulnerable endpoint is unauthenticated but executes in the authenticated user's browser session, the XSS can be chained to perform authenticated API actions on behalf of the victim and to exfiltrate sensitive data accessible to that origin. The provided context indicates high confidentiality and integrity impact, with no specific availability impact described.

If immediate upgrade is not possible, restrict or disable access to the vulnerable dynamic icon endpoint where feasible, especially unauthenticated exposure of GET /api/icon/getDynamicIcon. Reduce the likelihood of exploitation by preventing users from opening untrusted SiYuan links and by placing the application behind access controls that limit attacker reachability. Additional browser-side hardening such as a restrictive Content Security Policy may reduce exploitability, but the available information does not confirm whether CSP is supported or effective for this endpoint in the affected deployment.

Upgrade SiYuan to version 3.5.9 or later, where this issue has been patched. The underlying fix should ensure that attacker-controlled content included in the dynamic icon SVG response is properly escaped or otherwise prevented from being interpreted as executable SVG/HTML content in the type=8 code path of GET /api/icon/getDynamicIcon.