Siyuan-note vulnerabilities
220 CVEs and advisories name Siyuan-note as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-59832SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
- CVE-2026-59833SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)
- CVE-2026-59834SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
- CVE-2026-55570SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)
- CVE-2026-54759SiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client
- CVE-2026-50551SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
- CVE-2026-54158SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
- CVE-2026-54070SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
- CVE-2026-54069SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
- CVE-2026-54068SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon
- CVE-2026-54067SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
- CVE-2026-54066SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)
- CVE-2026-44670SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan
- CVE-2026-44588SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS
- CVE-2026-45147SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk
- CVE-2026-45148SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata
- CVE-2026-45371SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs
- CVE-2026-45375SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution
- CVE-2026-44586SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution
- CVE-2026-41894SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint
- CVE-2026-41421SiYuan Desktop Notification XSS Leads to Electron RCE
- CVE-2026-40922SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)
- CVE-2026-40322SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE
- CVE-2026-40318SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
- CVE-2026-40259SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API
- CVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
- CVE-2026-39846SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
- CVE-2026-34605SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )
- CVE-2026-34585SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution
- CVE-2026-34449SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection