Siyuan-note vulnerabilities
220 CVEs and advisories name Siyuan-note as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-34448SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client
- CVE-2026-34453SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content
- CVE-2026-33670SiYuan has directory traversal within its publishing service
- CVE-2026-33669SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33476SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal
- CVE-2026-33203SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
- CVE-2026-33194SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home
- CVE-2026-33067SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata
- CVE-2026-33066SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
- CVE-2026-32940SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
- CVE-2026-32938SiYuan has an Arbitrary File Read in its Desktop Publish Service
- CVE-2026-32767SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
- CVE-2026-32815SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure
- CVE-2026-32750SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes
- CVE-2026-32751SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface
- CVE-2026-32749SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write
- CVE-2026-32747SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets
- CVE-2026-32704SiYuan renderSprig: missing admin check allows any user to read full workspace DB
- CVE-2026-32110SiYuan has a Full-Read SSRF via /api/network/forwardProxy
- CVE-2026-31809SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS
- CVE-2026-31807SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS
- CVE-2026-30869SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
- CVE-2026-30926SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content
- CVE-2026-29183SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution
- CVE-2026-29073SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access
- CVE-2026-25992SiYuan has a File Read Interface Case Bypass Vulnerability
- CVE-2026-25647Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink
- CVE-2026-25539SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE
- CVE-2026-23852SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute
- CVE-2026-23851SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality