Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/siyuan-note/siyuan/kernel

116 known vulnerabilities (34 critical, 38 high, 42 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
116 · 34 critical, 38 high, 42 medium, 1 low
Registry
pkg.go.dev

Advisories 116

  • SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in…

    Affected: fixed in 0.0.0-20260729005258-4daee87d4152.

  • SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class…

    Affected: from 0.0.0-20260726161145-9b8e8956f997, fixed in 0.0.0-20260812083335-251596fc0de2.

  • SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

    Affected: through 3.8.4.

  • SiYuan through 3.8.4 Stored XSS via notebook names

    Affected: through 3.8.4.

  • CVE-2026-93921Medium 5.3

    SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint

    Affected: through 3.8.4.

  • SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

    Affected: fixed in 0.0.0-20260819144130-256d73aa7f94.

  • CVE-2026-82651Medium 6.9

    SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

    Affected: fixed in 0.0.0-20260816034002-035bf9a8c311.

  • SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU

    Affected: fixed in 0.0.0-20260813142806-dd2778b70d02.

  • CVE-2026-82233Medium 6.9

    SiYuan before v3.8.1 Path Traversal via asset.upload

    Affected: fixed in 0.0.0-20260813142104-b26a4a307b8a.

  • CVE-2026-62204Medium 5.9

    SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install

    Affected: fixed in 0.0.0-20260808010544-26ccb40d390e.

  • CVE-2026-60083Medium 6.9

    SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

    Affected: fixed in 0.0.0-20260808051406-3542530c505f.

  • SiYuan before v3.7.4 Missing Authorization via block API

    Affected: fixed in 0.0.0-20260804015139-bd067a4fe9b2.

  • SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy

    Affected: fixed in 0.0.0-20260803045322-cb67e0b4fab5.

  • SiYuan before v3.7.4 Authentication Bypass via WebSocket

    Affected: fixed in 0.0.0-20260731131820-67bc300b6ea6.

  • CVE-2026-73630Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess

    Affected: fixed in 0.0.0-20260731093152-c7522b8db586.

Show all 116 advisoriesShow fewer advisories
  • CVE-2026-73049Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

    Affected: fixed in 0.0.0-20260730150429-5b42614311b0.

  • CVE-2026-72812Medium 6.9

    SiYuan before v3.7.4 Missing Authorization via refreshBacklink

    Affected: fixed in 0.0.0-20260723002528-7d273c271ce1.

  • CVE-2026-72811Critical 9.9

    SiYuan before v3.7.4 SQL Injection via backlink search

    Affected: fixed in 0.0.0-20260723004839-1a5b3431d5ab.

  • CVE-2026-72810Critical 9.2

    SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket

    Affected: fixed in 0.0.0-20260723013612-ba948639d7f6.

  • CVE-2026-73609Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels

    Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

  • CVE-2026-73608Critical 9.2

    SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget

    Affected: from 0.0.0-20260726161145-9b8e8956f997, fixed in 0.0.0-20260812083335-251596fc0de2.

  • CVE-2026-73607Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via getOutlineStorage

    Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

  • CVE-2026-73606Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via getRefIDs

    Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

  • CVE-2026-73605Medium 6.9

    SiYuan before v3.7.4 Path Traversal via getUniqueFilename

    Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

  • SiYuan before v3.7.4 Authentication Bypass via Localhost Trust

    Affected: fixed in 0.0.0-20260723031701-9c16e9851f0b.

  • CVE-2026-72808Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via getFileAnnotation

    Affected: fixed in 0.0.0-20260723031702-509b35055940.

  • SiYuan before v3.7.4 SQL Injection via queryBlocks template

    Affected: fixed in 0.0.0-20260723035036-0a176345e02a.

  • CVE-2026-72806Medium 6.9

    SiYuan before v3.7.4 Authentication Bypass via Attribute View

    Affected: fixed in 0.0.0-20260723040913-768427f20f13.

  • CVE-2026-72805Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via Block Endpoints

    Affected: fixed in 0.0.0-20260723163028-931ba693375e.

  • CVE-2026-72804Critical 9.2

    SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints

    Affected: fixed in 0.0.0-20260724091654-82e9ded423e4.

  • CVE-2026-72803Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via getBlockAttrs

    Affected: fixed in 0.0.0-20260724093256-229fdffd7e4a.

  • CVE-2026-72802Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via resolveAssetPath

    Affected: fixed in 0.0.0-20260724095509-eee3410aa131.

  • SiYuan before v3.7.4 Information Disclosure via Encryption Key Material

    Affected: fixed in 0.0.0-20260724102025-3bc014c7dc32.

  • CVE-2026-72800Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via Unfiltered API

    Affected: fixed in 0.0.0-20260724103335-f36331956ae9.

  • CVE-2026-72799Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via Path Resolution

    Affected: fixed in 0.0.0-20260724112156-5bae0926b896.

  • CVE-2026-72798Critical 9.2

    SiYuan before v3.7.4 Information Disclosure via renderAttributeView

    Affected: fixed in 0.0.0-20260724121519-426991d155c0.

  • CVE-2026-72797Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus

    Affected: fixed in 0.0.0-20260724123622-8fb1b5766093.

  • CVE-2026-72796Medium 6.9

    SiYuan before v3.7.4 Access Control Bypass via Static Routes

    Affected: fixed in 0.0.0-20260725122641-34be6c0bb073.

  • CVE-2026-72795Critical 9.2

    SiYuan before v3.7.4 Information Disclosure via Embed Block

    Affected: fixed in 0.0.0-20260725125659-1ca1c3c9d94b.

  • CVE-2026-72794Critical 9.2

    siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

    Affected: fixed in 0.0.0-20260725123945-77421530be4a.

  • CVE-2026-72793Critical 9.2

    SiYuan before v3.7.4 Information Disclosure via /api/system/getConf

    Affected: fixed in 0.0.0-20260725132049-2d8b98395a91.

  • CVE-2026-72792Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via Tag API

    Affected: fixed in 0.0.0-20260726002639-4515fa257cfa.

  • CVE-2026-72791Medium 6.9

    SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews

    Affected: fixed in 0.0.0-20260726004013-64c26e74bb82.

  • CVE-2026-72790Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via getNotebookInfo

    Affected: fixed in 0.0.0-20260726005141-9edb321eb451.

  • CVE-2026-72789Critical 9.2

    SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks

    Affected: fixed in 0.0.0-20260726020813-a25c2dd06aae.

  • CVE-2026-72788Medium 6.9

    SiYuan before v3.7.4 Information Disclosure via UILayout Filter

    Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

  • SiYuan before v3.7.3 Path Traversal via unvalidated avID

    Affected: fixed in 0.0.0-20260720151813-0f5a0e7c67b0.

  • CVE-2026-69085Critical 9.9

    SiYuan before v3.7.3 SQL Injection via searchDocs

    Affected: fixed in 0.0.0-20260721043339-eef10568384e.

  • CVE-2026-69084Critical 9.9

    SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

    Affected: fixed in 0.0.0-20260721002947-23a17d44b5f3.

  • CVE-2026-69083Critical 9.9

    SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

    Affected: fixed in 0.0.0-20260721004815-cf42dd5680c8.

  • CVE-2026-68587Critical 9.2

    SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction

    Affected: fixed in 0.0.0-20260721013353-69db783b782a.

  • CVE-2026-68586Critical 9.2

    SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc

    Affected: fixed in 0.0.0-20260721014413-f45749a7ef6e.

  • CVE-2026-68585Medium 6.9

    SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo

    Affected: fixed in 0.0.0-20260721014951-ffde3b21eca4.

  • CVE-2026-68584Critical 9.2

    SiYuan before v3.7.3 Authentication Bypass via Content Endpoints

    Affected: fixed in 0.0.0-20260721020826-2d069dce84a2.

  • CVE-2026-66394Critical 9.3

    SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass

    Affected: fixed in 0.0.0-20260714095344-f08dee71ba8e.

  • SiYuan before v3.7.2 Path Traversal via /export/temp/

    Affected: fixed in 0.0.0-20260510110132-b763d787d1f2.

  • SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

    Affected: fixed in 0.0.0-20260704035520-68cc0f537dfa.

  • SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

    Affected: fixed in 0.0.0-20260704035518-d0f0fe146fb0.

  • CVE-2026-50551Critical 9.9

    SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

    Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

  • CVE-2026-54158Critical 9.9

    SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

    Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

  • SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

    Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

  • CVE-2026-54069Critical 9.2

    SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

    Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

  • CVE-2026-54068Medium 5.9

    SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

    Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

  • CVE-2026-54067Critical 9.9

    SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

    Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

  • SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)

    Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

  • CVE-2026-56397Critical 9.4

    SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

    Affected: through 0.0.0-20260313024916-fd6526133bb3; fixed in 0.0.0-20260317012524-fe4523fff2c8.

  • CVE-2026-44670Critical 9.4

    SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan

    Affected: fixed in 0.0.0-20260512140701-d7b77d945e0d.

  • CVE-2026-44588Critical 9.4

    SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS

    Affected: through 0.0.0-20260421031503-96dfe0bea474; all versions.

  • CVE-2026-45147Medium 4.3

    SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

    Affected: fixed in 0.0.0-20260512140701-d7b77d945e0d.

  • CVE-2026-45148Medium 4.3

    SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata

    Affected: fixed in 0.0.0-20260512140701-d7b77d945e0d.

  • SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

    Affected: fixed in 0.0.0-20260512140701-d7b77d945e0d.

  • CVE-2026-45375Critical 9.0

    SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

    Affected: through 0.0.0-20260421031503-96dfe0bea474; all versions.

  • SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint

    Affected: fixed in 3.6.5; all versions.

  • CVE-2026-40922Medium 5.3

    SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)

    Affected: fixed in 0.0.0-20260414013942-62eed37a3263.

  • SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

    Affected: all versions; fixed in 3.6.40.0.0-20260407035653-2f416e5253f1.

  • SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API

    Affected: fixed in 0.0.0-20260407035653-2f416e5253f1.

  • SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

    Affected: fixed in 0.0.0-20260407035653-2f416e5253f1.

  • CVE-2026-39846Critical 9.1

    SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

    Affected: fixed in 0.0.0-20260407035653-2f416e5253f1.

  • SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

    Affected: fixed in 0.0.0-20260330031106-f09953afc57a.

  • SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution

    Affected: fixed in 0.0.0-20260329142331-918d1bd9f967.

  • CVE-2026-34449Critical 9.7

    SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

    Affected: all versions; fixed in 3.6.2.

  • CVE-2026-34448Critical 9.1

    SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client

    Affected: fixed in 3.6.2; all versions.

  • SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked…

    Affected: all versions; fixed in 3.6.2.

  • CVE-2026-33670Critical 9.8

    SiYuan has directory traversal within its publishing service

    Affected: all versions; through 0.0.0-20260317012524-fe4523fff2c8.

  • CVE-2026-33669Critical 9.8

    SiYuan has Arbitrary Document Reading within the Publishing Service

    Affected: all versions; through 0.0.0-20260317012524-fe4523fff2c8.

  • SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal

    Affected: all versions; through 0.0.0-20260317012524-fe4523fff2c8.

  • SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

    Affected: fixed in 3.6.2.

  • CVE-2026-33194Medium 6.8

    SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home

    Affected: fixed in 3.6.2.

  • CVE-2026-33067Medium 5.3

    SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

    Affected: fixed in 0.0.0-20260317012524-fe4523fff2c8.

  • CVE-2026-33066Medium 5.3

    SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

    Affected: fixed in 0.0.0-20260314111550-b382f50e1880.

  • CVE-2026-32938Critical 9.9

    SiYuan has an Arbitrary File Read in its Desktop Publish Service

    Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.

  • CVE-2026-32767Critical 9.8

    SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

    Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.

  • CVE-2026-32815Medium 5.3

    SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

    Affected: all versions; through 0.0.0-20260313024916-fd6526133bb3.

  • CVE-2026-32751Medium 5.1

    SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

    Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.

  • SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

    Affected: all versions; through 0.0.0-20260313024916-fd6526133bb3.

  • CVE-2026-32747Medium 6.8

    SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets

    Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.

  • CVE-2026-32704Medium 6.5

    SiYuan renderSprig: missing admin check allows any user to read full workspace DB

    Affected: fixed in 3.6.1.

  • SiYuan has a Full-Read SSRF via /api/network/forwardProxy

    Affected: fixed in 3.6.0.

  • CVE-2026-31809Medium 6.4

    SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

    Affected: fixed in 0.0.0-20260310025236-297bd526708f.

  • CVE-2026-31807Medium 6.4

    SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

    Affected: fixed in 0.0.0-20260310025236-297bd526708f.

  • CVE-2026-30869Critical 9.3

    SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

    Affected: all versions; fixed in 3.5.10.

  • SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content

    Affected: through 0.0.0-20260304035530-d03ebdec8279; all versions.

  • CVE-2026-29183Critical 9.3

    SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution

    Affected: fixed in 0.0.0-20260304034809-d68bd5a79391.

  • CVE-2026-29073Medium 5.7

    SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access

    Affected: through 0.0.0-20260113130602-4ba64580c29c; all versions.

  • SiYuan has a File Read Interface Case Bypass Vulnerability

    Affected: through 0.0.0-20260126094835-d5d10dd41b0c; all versions.

  • CVE-2026-25539Critical 9.1

    SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

    Affected: all versions; through 0.0.0-20260126094835-d5d10dd41b0c.

  • SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

    Affected: fixed in 0.0.0-20260118092521-f8f4b517077b.

  • SiYuan vulnerable to arbitrary file read

    Affected: fixed in 0.0.0-20260118092326-b2274baba2e1.

  • SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

    Affected: fixed in 0.0.0-20260118021606-5c0cc375b475.

  • CVE-2026-23645Medium 5.3

    SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload

    Affected: fixed in 0.0.0-20260116101155-11115da3d0de.

  • SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

    Affected: all versions; through 0.0.0-20251202123337-6ef83b42c7ce.

  • SiYuan has an arbitrary file deletion vulnerability

    Affected: all versions.

  • CVE-2024-55660Medium 6.9

    SiYuan has an SSTI via /api/template/renderSprig

    Affected: through 0.0.0-20241210012039-5129ad926a21; all versions.

  • SiYuan has an arbitrary file write in the host via /api/asset/upload

    Affected: all versions; through 0.0.0-20241210012039-5129ad926a21.

  • SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

    Affected: through 0.0.0-20241210012039-5129ad926a21; all versions.

  • SiYuan has an arbitrary file read via /api/template/render

    Affected: through 0.0.0-20241210012039-5129ad926a21; all versions.