GoPackage

github.com/siyuan-note/siyuan

2 known vulnerabilities (1 critical, 1 medium), with the versions each affects and the releases that fix them.

Latest release: v3.8.7+incompatible (Oct 14, 2026): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 1 critical, 1 medium

Releases: 500+ since v3.0.15+incompatible (May 21, 2024)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-32940
Affects v3.0.15-dev2.0.20240521004347-5adb01ef8505+incompatible to v3.8.7+incompatible (through the newest release)
CVE-2026-32750
Affects v3.0.15-dev2.0.20240521004347-5adb01ef8505+incompatible to v3.8.7+incompatible (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

CVE-2026-32940Critical 9.3
SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
Affected: all versions; through 0.0.0-20260313024916-fd6526133bb3.
No fix released. The latest release, v3.8.7+incompatible, is still affected.
CVE-2026-32750Medium 6.8
SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes
Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.
No fix released. The latest release, v3.8.7+incompatible, is still affected.