SiYuan CVE-2026-82234

Exploitation requires three concurrent conditions: (1) the attacker can supply or influence a URL that SiYuan's http_request or web_fetch agent tools will process - for example, via a shared note, plugin configuration, or attacker-controlled content rendered by the application; (2) the attacker controls a DNS server for a domain they own and can manipulate DNS record TTLs to execute the rebinding timing race; (3) the SiYuan instance has network reachability to the target private or metadata IP, making cloud-hosted deployments with access to 169.254.169.254 the highest-risk scenario. The CVSS 4.0 UI:P metric confirms that passive user interaction - SiYuan processing attacker-influenced content - is required, preventing fully automated exploitation. Deployments where SiYuan runs on isolated networks without cloud metadata access or internal network reachability face materially reduced risk even on unpatched versions.

The CVSS 4.0 score of 8.4 is well-supported by the subsequent-system confidentiality impact (SC:H), which reflects the realistic threat of cloud credential theft via metadata service access - a severe outcome for any cloud-hosted SiYuan deployment. The network attack vector and no-privileges-required metrics lower the barrier considerably, while the passive user interaction requirement (UI:P) means the attacker must induce SiYuan to process attacker-controlled content rather than exploiting it fully autonomously. The provided vector assigns AC:L, but DNS rebinding realistically requires controlling DNS infrastructure and managing TTL timing windows, which adds non-trivial operational complexity not captured by that metric; defenders should weigh this when prioritizing. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so active or widespread exploitation is unconfirmed - but the attack surface (cloud-deployed note-taking applications processing external URLs) is a realistic opportunistic target, particularly where IMDSv1 is still enabled.

An attacker registers a domain under their control with a DNS server they operate, sets a very short TTL, and crafts a SiYuan note or plugin payload referencing a URL on that domain - delivered, for example, via a shared notebook or template. When SiYuan processes the URL, the guard-time DNS resolution returns a legitimate public IP that passes the blocklist check; the attacker immediately flips the DNS record to 169.254.169.254 before SiYuan opens the TCP connection. SiYuan connects to the AWS instance metadata endpoint and returns IAM role credentials or identity documents to the attacker. No public proof-of-concept is identified at time of analysis, though DNS rebinding frameworks such as Singularity are publicly available and significantly reduce the technical barrier.