Skip to main content

SiYuan CVE-2026-74799

| EUVDEUVD-2026-60082 CRITICAL
Insertion of Sensitive Information Into Debugging Code (CWE-215)
2026-08-17 VulnCheck GHSA-hmr2-j8m8-f585
Information Disclosure Siyuan
9.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.3 CRITICAL

Remote unauthenticated read against the default non-prod mode (PR:N/AC:L); scope changes because leaked AI keys compromise separate systems (S:C, C:H); minor availability from profiling load, no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 17, 2026 - 13:23 vuln.today
Patch available
Aug 17, 2026 - 12:01 EUVD
CVE Published
Aug 17, 2026 - 11:04 cve.org
CRITICAL 9.2

DescriptionCVE.org

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

AnalysisAI

Unauthenticated information disclosure in SiYuan before 3.7.4 exposes Go net/http/pprof debug endpoints (heap, goroutine, and related dumps) to any remote client whenever the application is not started with --mode set exactly to prod. Because non-prod is the effective default, attackers can query /debug/pprof/heap to scrape live process memory and recover secrets such as the AccessAuthCode and configured AI provider API keys. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Discover reachable SiYuan HTTP port
Delivery
Send unauthenticated GET /debug/pprof/heap
Exploit
Server returns in-memory heap dump
Execution
Parse dump for AccessAuthCode and API keys
Impact
Reuse secrets to access workspace and AI accounts
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The SiYuan process must be running with its runtime --mode flag NOT set to exactly the string 'prod' (including the default case where the flag is omitted), which causes the net/http/pprof handlers to be registered, and the HTTP listener must be reachable by the attacker (bound to a non-loopback interface or exposed via a proxy). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H, VA:L, SC:H/SA:L, score 9.2) describes a remote, low-complexity, unauthenticated read of high-value confidentiality data, with the subsequent-system metrics reflecting that stolen AI API keys and the AccessAuthCode enable follow-on compromise of other systems and the SiYuan instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach a SiYuan instance's HTTP port (started without --mode=prod, e.g. a home lab or small-team server exposed to a LAN or the internet) sends an unauthenticated GET to /debug/pprof/heap and downloads the heap profile. …
Remediation Upgrade to SiYuan 3.7.4 or later, which removes unauthenticated exposure of the pprof debug endpoints; this is the primary fix per vendor advisory GHSA-9cqq-p2hw-mj3f. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify and inventory all SiYuan deployments across your organization, prioritizing those not explicitly running in production mode, and assess exposure to public networks. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Siyuan

View all
CVE-2026-69084 CRITICAL POC
9.9 Aug 03

SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements

CVE-2024-53507 CRITICAL POC
9.8 Nov 29

A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
CVE-2024-53506 CRITICAL POC
9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
CVE-2024-53505 CRITICAL POC
9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
CVE-2024-53504 CRITICAL POC
9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
CVE-2026-23852 CRITICAL POC
9.6 Jan 19

SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
CVE-2026-54069 CRITICAL POC
9.2 Jun 24

Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
CVE-2026-29183 CRITICAL POC
9.3 Mar 06

Reflected XSS in SiYuan knowledge management before 3.5.9.
CVE-2026-25539 CRITICAL POC
9.1 Feb 04

SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
CVE-2024-2692 CRITICAL POC
9.0 Apr 04

SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
CVE-2026-29073 HIGH POC
8.8 Mar 06

SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to

CVE-2026-34605 HIGH POC
8.6 Mar 31

Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t

Same weakness CWE-215 – Insertion of Sensitive Information Into Debugging Code

View all
CVE-2022-0721 MEDIUM POC
6.5
CVE-2024-7569 CRITICAL
9.8
CVE-2019-3781 HIGH
8.8
CVE-2018-1191 HIGH
8.8
CVE-2025-27684 HIGH
7.5
CVE-2026-2250 HIGH
7.5
CVE-2025-34081 HIGH
7.5
CVE-2023-51390 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-74799 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy