# github.com/siyuan-note/siyuan/kernel (Go) vulnerabilities

116 known vulnerabilities (34 critical, 38 high, 42 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/siyuan-note/siyuan/kernel

## Advisories (116)

### [GO-2026-6836](https://cve.now/GO-2026-6836): SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in…

- Severity: Unrated
- Published: Nov 5, 2026
- Affected: fixed in 0.0.0-20260729005258-4daee87d4152.

### [GHSA-9CQF-HHRQ-7V45](https://cve.now/GHSA-9CQF-HHRQ-7V45): SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class…

- Severity: High
- Published: Oct 1, 2026
- Affected: from 0.0.0-20260726161145-9b8e8956f997, fixed in 0.0.0-20260812083335-251596fc0de2.

### [CVE-2026-93923](https://cve.now/CVE-2026-93923): SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

- Severity: High 8.6
- Published: Sep 18, 2026
- Affected: through 3.8.4.

### [CVE-2026-93922](https://cve.now/CVE-2026-93922): SiYuan through 3.8.4 Stored XSS via notebook names

- Severity: High 8.6
- Published: Sep 18, 2026
- Affected: through 3.8.4.

### [CVE-2026-93921](https://cve.now/CVE-2026-93921): SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint

- Severity: Medium 5.3
- Published: Sep 18, 2026
- Affected: through 3.8.4.

### [CVE-2026-85175](https://cve.now/CVE-2026-85175): SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

- Severity: High 8.7
- Published: Sep 3, 2026
- Affected: fixed in 0.0.0-20260819144130-256d73aa7f94.

### [CVE-2026-82651](https://cve.now/CVE-2026-82651): SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

- Severity: Medium 6.9
- Published: Aug 30, 2026
- Affected: fixed in 0.0.0-20260816034002-035bf9a8c311.

### [CVE-2026-82234](https://cve.now/CVE-2026-82234): SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU

- Severity: High 8.4
- Published: Aug 28, 2026
- Affected: fixed in 0.0.0-20260813142806-dd2778b70d02.

### [CVE-2026-82233](https://cve.now/CVE-2026-82233): SiYuan before v3.8.1 Path Traversal via asset.upload

- Severity: Medium 6.9
- Published: Aug 28, 2026
- Affected: fixed in 0.0.0-20260813142104-b26a4a307b8a.

### [CVE-2026-62204](https://cve.now/CVE-2026-62204): SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install

- Severity: Medium 5.9
- Published: Aug 22, 2026
- Affected: fixed in 0.0.0-20260808010544-26ccb40d390e.

### [CVE-2026-60083](https://cve.now/CVE-2026-60083): SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

- Severity: Medium 6.9
- Published: Aug 22, 2026
- Affected: fixed in 0.0.0-20260808051406-3542530c505f.

### [CVE-2026-74904](https://cve.now/CVE-2026-74904): SiYuan before v3.7.4 Missing Authorization via block API

- Severity: High 8.7
- Published: Aug 18, 2026
- Affected: fixed in 0.0.0-20260804015139-bd067a4fe9b2.

### [CVE-2026-74802](https://cve.now/CVE-2026-74802): SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy

- Severity: High 7.1
- Published: Aug 17, 2026
- Affected: fixed in 0.0.0-20260803045322-cb67e0b4fab5.

### [CVE-2026-73054](https://cve.now/CVE-2026-73054): SiYuan before v3.7.4 Authentication Bypass via WebSocket

- Severity: High 8.7
- Published: Aug 15, 2026
- Affected: fixed in 0.0.0-20260731131820-67bc300b6ea6.

### [CVE-2026-73630](https://cve.now/CVE-2026-73630): SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess

- Severity: Medium 6.9
- Published: Aug 14, 2026
- Affected: fixed in 0.0.0-20260731093152-c7522b8db586.

### [CVE-2026-73049](https://cve.now/CVE-2026-73049): SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

- Severity: Medium 6.9
- Published: Aug 14, 2026
- Affected: fixed in 0.0.0-20260730150429-5b42614311b0.

### [CVE-2026-72812](https://cve.now/CVE-2026-72812): SiYuan before v3.7.4 Missing Authorization via refreshBacklink

- Severity: Medium 6.9
- Published: Aug 14, 2026
- Affected: fixed in 0.0.0-20260723002528-7d273c271ce1.

### [CVE-2026-72811](https://cve.now/CVE-2026-72811): SiYuan before v3.7.4 SQL Injection via backlink search

- Severity: Critical 9.9
- Published: Aug 14, 2026
- Affected: fixed in 0.0.0-20260723004839-1a5b3431d5ab.

### [CVE-2026-72810](https://cve.now/CVE-2026-72810): SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket

- Severity: Critical 9.2
- Published: Aug 14, 2026
- Affected: fixed in 0.0.0-20260723013612-ba948639d7f6.

### [CVE-2026-73609](https://cve.now/CVE-2026-73609): SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels

- Severity: Medium 6.9
- Published: Aug 13, 2026
- Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

### [CVE-2026-73608](https://cve.now/CVE-2026-73608): SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget

- Severity: Critical 9.2
- Published: Aug 13, 2026
- Affected: from 0.0.0-20260726161145-9b8e8956f997, fixed in 0.0.0-20260812083335-251596fc0de2.

### [CVE-2026-73607](https://cve.now/CVE-2026-73607): SiYuan before v3.7.4 Information Disclosure via getOutlineStorage

- Severity: Medium 6.9
- Published: Aug 13, 2026
- Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

### [CVE-2026-73606](https://cve.now/CVE-2026-73606): SiYuan before v3.7.4 Information Disclosure via getRefIDs

- Severity: Medium 6.9
- Published: Aug 13, 2026
- Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

### [CVE-2026-73605](https://cve.now/CVE-2026-73605): SiYuan before v3.7.4 Path Traversal via getUniqueFilename

- Severity: Medium 6.9
- Published: Aug 13, 2026
- Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

### [CVE-2026-72809](https://cve.now/CVE-2026-72809): SiYuan before v3.7.4 Authentication Bypass via Localhost Trust

- Severity: High 7.1
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260723031701-9c16e9851f0b.

### [CVE-2026-72808](https://cve.now/CVE-2026-72808): SiYuan before v3.7.4 Information Disclosure via getFileAnnotation

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260723031702-509b35055940.

### [CVE-2026-72807](https://cve.now/CVE-2026-72807): SiYuan before v3.7.4 SQL Injection via queryBlocks template

- Severity: High 8.8
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260723035036-0a176345e02a.

### [CVE-2026-72806](https://cve.now/CVE-2026-72806): SiYuan before v3.7.4 Authentication Bypass via Attribute View

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260723040913-768427f20f13.

### [CVE-2026-72805](https://cve.now/CVE-2026-72805): SiYuan before v3.7.4 Information Disclosure via Block Endpoints

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260723163028-931ba693375e.

### [CVE-2026-72804](https://cve.now/CVE-2026-72804): SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints

- Severity: Critical 9.2
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260724091654-82e9ded423e4.

### [CVE-2026-72803](https://cve.now/CVE-2026-72803): SiYuan before v3.7.4 Information Disclosure via getBlockAttrs

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260724093256-229fdffd7e4a.

### [CVE-2026-72802](https://cve.now/CVE-2026-72802): SiYuan before v3.7.4 Information Disclosure via resolveAssetPath

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260724095509-eee3410aa131.

### [CVE-2026-72801](https://cve.now/CVE-2026-72801): SiYuan before v3.7.4 Information Disclosure via Encryption Key Material

- Severity: High 8.7
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260724102025-3bc014c7dc32.

### [CVE-2026-72800](https://cve.now/CVE-2026-72800): SiYuan before v3.7.4 Information Disclosure via Unfiltered API

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260724103335-f36331956ae9.

### [CVE-2026-72799](https://cve.now/CVE-2026-72799): SiYuan before v3.7.4 Information Disclosure via Path Resolution

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260724112156-5bae0926b896.

### [CVE-2026-72798](https://cve.now/CVE-2026-72798): SiYuan before v3.7.4 Information Disclosure via renderAttributeView

- Severity: Critical 9.2
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260724121519-426991d155c0.

### [CVE-2026-72797](https://cve.now/CVE-2026-72797): SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260724123622-8fb1b5766093.

### [CVE-2026-72796](https://cve.now/CVE-2026-72796): SiYuan before v3.7.4 Access Control Bypass via Static Routes

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260725122641-34be6c0bb073.

### [CVE-2026-72795](https://cve.now/CVE-2026-72795): SiYuan before v3.7.4 Information Disclosure via Embed Block

- Severity: Critical 9.2
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260725125659-1ca1c3c9d94b.

### [CVE-2026-72794](https://cve.now/CVE-2026-72794): siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

- Severity: Critical 9.2
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260725123945-77421530be4a.

### [CVE-2026-72793](https://cve.now/CVE-2026-72793): SiYuan before v3.7.4 Information Disclosure via /api/system/getConf

- Severity: Critical 9.2
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260725132049-2d8b98395a91.

### [CVE-2026-72792](https://cve.now/CVE-2026-72792): SiYuan before v3.7.4 Information Disclosure via Tag API

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260726002639-4515fa257cfa.

### [CVE-2026-72791](https://cve.now/CVE-2026-72791): SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260726004013-64c26e74bb82.

### [CVE-2026-72790](https://cve.now/CVE-2026-72790): SiYuan before v3.7.4 Information Disclosure via getNotebookInfo

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260726005141-9edb321eb451.

### [CVE-2026-72789](https://cve.now/CVE-2026-72789): SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks

- Severity: Critical 9.2
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260726020813-a25c2dd06aae.

### [CVE-2026-72788](https://cve.now/CVE-2026-72788): SiYuan before v3.7.4 Information Disclosure via UILayout Filter

- Severity: Medium 6.9
- Published: Aug 12, 2026
- Affected: fixed in 0.0.0-20260812083335-251596fc0de2.

### [CVE-2026-69086](https://cve.now/CVE-2026-69086): SiYuan before v3.7.3 Path Traversal via unvalidated avID

- Severity: High 8.3
- Published: Aug 3, 2026
- Affected: fixed in 0.0.0-20260720151813-0f5a0e7c67b0.

### [CVE-2026-69085](https://cve.now/CVE-2026-69085): SiYuan before v3.7.3 SQL Injection via searchDocs

- Severity: Critical 9.9
- Published: Aug 3, 2026
- Affected: fixed in 0.0.0-20260721043339-eef10568384e.

### [CVE-2026-69084](https://cve.now/CVE-2026-69084): SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

- Severity: Critical 9.9
- Published: Aug 3, 2026
- Affected: fixed in 0.0.0-20260721002947-23a17d44b5f3.

### [CVE-2026-69083](https://cve.now/CVE-2026-69083): SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

- Severity: Critical 9.9
- Published: Aug 3, 2026
- Affected: fixed in 0.0.0-20260721004815-cf42dd5680c8.

### [CVE-2026-68587](https://cve.now/CVE-2026-68587): SiYuan before v3.7.3 Information Disclosure via getHeading\*Transaction

- Severity: Critical 9.2
- Published: Aug 3, 2026
- Affected: fixed in 0.0.0-20260721013353-69db783b782a.

### [CVE-2026-68586](https://cve.now/CVE-2026-68586): SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc

- Severity: Critical 9.2
- Published: Aug 3, 2026
- Affected: fixed in 0.0.0-20260721014413-f45749a7ef6e.

### [CVE-2026-68585](https://cve.now/CVE-2026-68585): SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo

- Severity: Medium 6.9
- Published: Aug 3, 2026
- Affected: fixed in 0.0.0-20260721014951-ffde3b21eca4.

### [CVE-2026-68584](https://cve.now/CVE-2026-68584): SiYuan before v3.7.3 Authentication Bypass via Content Endpoints

- Severity: Critical 9.2
- Published: Aug 3, 2026
- Affected: fixed in 0.0.0-20260721020826-2d069dce84a2.

### [CVE-2026-66394](https://cve.now/CVE-2026-66394): SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass

- Severity: Critical 9.3
- Published: Jul 27, 2026
- Affected: fixed in 0.0.0-20260714095344-f08dee71ba8e.

### [CVE-2026-65607](https://cve.now/CVE-2026-65607): SiYuan before v3.7.2 Path Traversal via /export/temp/

- Severity: High 7.1
- Published: Jul 23, 2026
- Affected: fixed in 0.0.0-20260510110132-b763d787d1f2.

### [CVE-2026-59832](https://cve.now/CVE-2026-59832): SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

- Severity: High 7.7
- Published: Jul 9, 2026
- Affected: fixed in 0.0.0-20260704035520-68cc0f537dfa.

### [CVE-2026-59834](https://cve.now/CVE-2026-59834): SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

- Severity: High 7.5
- Published: Jul 9, 2026
- Affected: fixed in 0.0.0-20260704035518-d0f0fe146fb0.

### [CVE-2026-50551](https://cve.now/CVE-2026-50551): SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

- Severity: Critical 9.9
- Published: Jun 24, 2026
- Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

### [CVE-2026-54158](https://cve.now/CVE-2026-54158): SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

- Severity: Critical 9.9
- Published: Jun 24, 2026
- Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

### [CVE-2026-54070](https://cve.now/CVE-2026-54070): SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

- Severity: High 7.1
- Published: Jun 24, 2026
- Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

### [CVE-2026-54069](https://cve.now/CVE-2026-54069): SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

- Severity: Critical 9.2
- Published: Jun 24, 2026
- Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

### [CVE-2026-54068](https://cve.now/CVE-2026-54068): SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

- Severity: Medium 5.9
- Published: Jun 24, 2026
- Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

### [CVE-2026-54067](https://cve.now/CVE-2026-54067): SiYuan: Stored XSS to RCE via CSS-snippet \<style\> breakout in renderSnippet()

- Severity: Critical 9.9
- Published: Jun 24, 2026
- Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

### [CVE-2026-54066](https://cve.now/CVE-2026-54066): SiYuan: Path Traversal via Double URL Encoding in /assets/\*path (publish mode arbitrary file─read)

- Severity: High 7.5
- Published: Jun 24, 2026
- Affected: fixed in 0.0.0-20260628153353-2d5d72223df4.

### [CVE-2026-56397](https://cve.now/CVE-2026-56397): SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

- Severity: Critical 9.4
- Published: Jun 21, 2026
- Affected: through 0.0.0-20260313024916-fd6526133bb3; fixed in 0.0.0-20260317012524-fe4523fff2c8.

### [CVE-2026-44670](https://cve.now/CVE-2026-44670): SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan

- Severity: Critical 9.4
- Published: May 14, 2026
- Affected: fixed in 0.0.0-20260512140701-d7b77d945e0d.

### [CVE-2026-44588](https://cve.now/CVE-2026-44588): SiYuan: URL-encoded title bypasses \`escapeAriaLabel\`, decoded by \`decodeURIComponent\` into a tooltip-XSS

- Severity: Critical 9.4
- Published: May 14, 2026
- Affected: through 0.0.0-20260421031503-96dfe0bea474; all versions.

### [CVE-2026-45147](https://cve.now/CVE-2026-45147): SiYuan: Broken access control in SiYuan \`/api/tag/getTag\` — Reader role can mutate \`Conf.Tag.Sort\` and persist to disk

- Severity: Medium 4.3
- Published: May 14, 2026
- Affected: fixed in 0.0.0-20260512140701-d7b77d945e0d.

### [CVE-2026-45148](https://cve.now/CVE-2026-45148): SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata

- Severity: Medium 4.3
- Published: May 14, 2026
- Affected: fixed in 0.0.0-20260512140701-d7b77d945e0d.

### [CVE-2026-45371](https://cve.now/CVE-2026-45371): SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

- Severity: High 7.2
- Published: May 14, 2026
- Affected: fixed in 0.0.0-20260512140701-d7b77d945e0d.

### [CVE-2026-45375](https://cve.now/CVE-2026-45375): SiYuan: Bazaar marketplace renders unescaped package \`name\` and \`version\` metadata, allowing stored XSS and Electron code execution

- Severity: Critical 9.0
- Published: May 14, 2026
- Affected: through 0.0.0-20260421031503-96dfe0bea474; all versions.

### [CVE-2026-41894](https://cve.now/CVE-2026-41894): SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in \`/export/\` Endpoint

- Severity: High 7.1
- Published: Apr 24, 2026
- Affected: fixed in 3.6.5; all versions.

### [CVE-2026-40922](https://cve.now/CVE-2026-40922): SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)

- Severity: Medium 5.3
- Published: Apr 16, 2026
- Affected: fixed in 0.0.0-20260414013942-62eed37a3263.

### [CVE-2026-40318](https://cve.now/CVE-2026-40318): SiYuan: Publish Reader Path Traversal Delete via \`removeUnusedAttributeView\`

- Severity: High 8.5
- Published: Apr 16, 2026
- Affected: all versions; fixed in 3.6.40.0.0-20260407035653-2f416e5253f1.

### [CVE-2026-40259](https://cve.now/CVE-2026-40259): SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API

- Severity: High 8.1
- Published: Apr 16, 2026
- Affected: fixed in 0.0.0-20260407035653-2f416e5253f1.

### [CVE-2026-40107](https://cve.now/CVE-2026-40107): SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

- Severity: High 8.7
- Published: Apr 9, 2026
- Affected: fixed in 0.0.0-20260407035653-2f416e5253f1.

### [CVE-2026-39846](https://cve.now/CVE-2026-39846): SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

- Severity: Critical 9.1
- Published: Apr 7, 2026
- Affected: fixed in 0.0.0-20260407035653-2f416e5253f1.

### [CVE-2026-34605](https://cve.now/CVE-2026-34605): SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

- Severity: High 8.6
- Published: Mar 31, 2026
- Affected: fixed in 0.0.0-20260330031106-f09953afc57a.

### [CVE-2026-34585](https://cve.now/CVE-2026-34585): SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution

- Severity: High 8.6
- Published: Mar 31, 2026
- Affected: fixed in 0.0.0-20260329142331-918d1bd9f967.

### [CVE-2026-34449](https://cve.now/CVE-2026-34449): SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

- Severity: Critical 9.7
- Published: Mar 31, 2026
- Affected: all versions; fixed in 3.6.2.

### [CVE-2026-34448](https://cve.now/CVE-2026-34448): SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client

- Severity: Critical 9.1
- Published: Mar 31, 2026
- Affected: fixed in 3.6.2; all versions.

### [CVE-2026-34453](https://cve.now/CVE-2026-34453): SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked…

- Severity: High 7.5
- Published: Mar 31, 2026
- Affected: all versions; fixed in 3.6.2.

### [CVE-2026-33670](https://cve.now/CVE-2026-33670): SiYuan has directory traversal within its publishing service

- Severity: Critical 9.8
- Published: Mar 26, 2026
- Affected: all versions; through 0.0.0-20260317012524-fe4523fff2c8.

### [CVE-2026-33669](https://cve.now/CVE-2026-33669): SiYuan has Arbitrary Document Reading within the Publishing Service

- Severity: Critical 9.8
- Published: Mar 26, 2026
- Affected: all versions; through 0.0.0-20260317012524-fe4523fff2c8.

### [CVE-2026-33476](https://cve.now/CVE-2026-33476): SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal

- Severity: High 7.5
- Published: Mar 20, 2026
- Affected: all versions; through 0.0.0-20260317012524-fe4523fff2c8.

### [CVE-2026-33203](https://cve.now/CVE-2026-33203): SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

- Severity: High 7.5
- Published: Mar 20, 2026
- Affected: fixed in 3.6.2.

### [CVE-2026-33194](https://cve.now/CVE-2026-33194): SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home

- Severity: Medium 6.8
- Published: Mar 20, 2026
- Affected: fixed in 3.6.2.

### [CVE-2026-33067](https://cve.now/CVE-2026-33067): SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

- Severity: Medium 5.3
- Published: Mar 20, 2026
- Affected: fixed in 0.0.0-20260317012524-fe4523fff2c8.

### [CVE-2026-33066](https://cve.now/CVE-2026-33066): SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

- Severity: Medium 5.3
- Published: Mar 20, 2026
- Affected: fixed in 0.0.0-20260314111550-b382f50e1880.

### [CVE-2026-32938](https://cve.now/CVE-2026-32938): SiYuan has an Arbitrary File Read in its Desktop Publish Service

- Severity: Critical 9.9
- Published: Mar 20, 2026
- Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.

### [CVE-2026-32767](https://cve.now/CVE-2026-32767): SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

- Severity: Critical 9.8
- Published: Mar 20, 2026
- Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.

### [CVE-2026-32815](https://cve.now/CVE-2026-32815): SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

- Severity: Medium 5.3
- Published: Mar 19, 2026
- Affected: all versions; through 0.0.0-20260313024916-fd6526133bb3.

### [CVE-2026-32751](https://cve.now/CVE-2026-32751): SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

- Severity: Medium 5.1
- Published: Mar 19, 2026
- Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.

### [CVE-2026-32749](https://cve.now/CVE-2026-32749): SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

- Severity: High 7.6
- Published: Mar 19, 2026
- Affected: all versions; through 0.0.0-20260313024916-fd6526133bb3.

### [CVE-2026-32747](https://cve.now/CVE-2026-32747): SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets

- Severity: Medium 6.8
- Published: Mar 19, 2026
- Affected: through 0.0.0-20260313024916-fd6526133bb3; all versions.

### [CVE-2026-32704](https://cve.now/CVE-2026-32704): SiYuan renderSprig: missing admin check allows any user to read full workspace DB

- Severity: Medium 6.5
- Published: Mar 13, 2026
- Affected: fixed in 3.6.1.

### [CVE-2026-32110](https://cve.now/CVE-2026-32110): SiYuan has a Full-Read SSRF via /api/network/forwardProxy

- Severity: High 8.3
- Published: Mar 11, 2026
- Affected: fixed in 3.6.0.

### [CVE-2026-31809](https://cve.now/CVE-2026-31809): SiYuan has a SVG Sanitizer Bypass via Whitespace in \`javascript:\` URI — Unauthenticated XSS

- Severity: Medium 6.4
- Published: Mar 10, 2026
- Affected: fixed in 0.0.0-20260310025236-297bd526708f.

### [CVE-2026-31807](https://cve.now/CVE-2026-31807): SiYuan has a SVG Sanitizer Bypass via \`\<animate\>\` Element — Unauthenticated XSS

- Severity: Medium 6.4
- Published: Mar 10, 2026
- Affected: fixed in 0.0.0-20260310025236-297bd526708f.

### [CVE-2026-30869](https://cve.now/CVE-2026-30869): SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

- Severity: Critical 9.3
- Published: Mar 9, 2026
- Affected: all versions; fixed in 3.5.10.

### [CVE-2026-30926](https://cve.now/CVE-2026-30926): SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content

- Severity: High 7.1
- Published: Mar 9, 2026
- Affected: through 0.0.0-20260304035530-d03ebdec8279; all versions.

### [CVE-2026-29183](https://cve.now/CVE-2026-29183): SiYuan: Unauthenticated reflected SVG XSS in \`/api/icon/getDynamicIcon\` (\`type=8\`) enables arbitrary JavaScript execution

- Severity: Critical 9.3
- Published: Mar 6, 2026
- Affected: fixed in 0.0.0-20260304034809-d68bd5a79391.

### [CVE-2026-29073](https://cve.now/CVE-2026-29073): SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access

- Severity: Medium 5.7
- Published: Mar 6, 2026
- Affected: through 0.0.0-20260113130602-4ba64580c29c; all versions.

### [CVE-2026-25992](https://cve.now/CVE-2026-25992): SiYuan has a File Read Interface Case Bypass Vulnerability

- Severity: High 7.5
- Published: Feb 10, 2026
- Affected: through 0.0.0-20260126094835-d5d10dd41b0c; all versions.

### [CVE-2026-25539](https://cve.now/CVE-2026-25539): SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

- Severity: Critical 9.1
- Published: Feb 4, 2026
- Affected: all versions; through 0.0.0-20260126094835-d5d10dd41b0c.

### [CVE-2026-23851](https://cve.now/CVE-2026-23851): SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

- Severity: High 8.3
- Published: Jan 19, 2026
- Affected: fixed in 0.0.0-20260118092521-f8f4b517077b.

### [CVE-2026-23850](https://cve.now/CVE-2026-23850): SiYuan vulnerable to arbitrary file read

- Severity: High 7.8
- Published: Jan 19, 2026
- Affected: fixed in 0.0.0-20260118092326-b2274baba2e1.

### [CVE-2026-23847](https://cve.now/CVE-2026-23847): SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

- Severity: Low 2.1
- Published: Jan 19, 2026
- Affected: fixed in 0.0.0-20260118021606-5c0cc375b475.

### [CVE-2026-23645](https://cve.now/CVE-2026-23645): SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload

- Severity: Medium 5.3
- Published: Jan 16, 2026
- Affected: fixed in 0.0.0-20260116101155-11115da3d0de.

### [CVE-2025-67488](https://cve.now/CVE-2025-67488): SiYuan: ZipSlip -\> Arbitrary File Overwrite -\> RCE

- Severity: High 7.8
- Published: Dec 9, 2025
- Affected: all versions; through 0.0.0-20251202123337-6ef83b42c7ce.

### [CVE-2025-21609](https://cve.now/CVE-2025-21609): SiYuan has an arbitrary file deletion vulnerability

- Severity: High 8.7
- Published: Jan 3, 2025
- Affected: all versions.

### [CVE-2024-55660](https://cve.now/CVE-2024-55660): SiYuan has an SSTI via /api/template/renderSprig

- Severity: Medium 6.9
- Published: Dec 11, 2024
- Affected: through 0.0.0-20241210012039-5129ad926a21; all versions.

### [CVE-2024-55659](https://cve.now/CVE-2024-55659): SiYuan has an arbitrary file write in the host via /api/asset/upload

- Severity: High 8.7
- Published: Dec 11, 2024
- Affected: all versions; through 0.0.0-20241210012039-5129ad926a21.

### [CVE-2024-55658](https://cve.now/CVE-2024-55658): SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

- Severity: High 8.7
- Published: Dec 11, 2024
- Affected: through 0.0.0-20241210012039-5129ad926a21; all versions.

### [CVE-2024-55657](https://cve.now/CVE-2024-55657): SiYuan has an arbitrary file read via /api/template/render

- Severity: High 8.7
- Published: Dec 11, 2024
- Affected: through 0.0.0-20241210012039-5129ad926a21; all versions.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/siyuan-note/siyuan/kernel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.