EUVD-2026-60085
GHSA-x8p6-569w-fmmr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Network vector via browser; High complexity requires victim running SiYuan and visiting malicious page; PR:L for admin session context; Scope Changed captures proxy reaching other network systems.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Lifecycle Timeline
2DescriptionCVE.org
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.
AnalysisAI
Cross-site WebSocket hijacking in SiYuan before version 3.7.4 exposes an admin-only /ws/network/proxy endpoint that unconditionally bypasses origin validation, allowing attacker-controlled webpages to silently establish WebSocket connections through the victim's running SiYuan kernel. Any webpage visited by the victim can issue proxy directives, directing the SiYuan process to forward arbitrary network traffic to attacker-chosen targets and effectively turning the victim's machine into a pivot point into their internal network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the victim is running a SiYuan version before 3.7.4 with its local kernel process active and listening on a discoverable port; (2) the victim's browser navigates to an attacker-controlled webpage capable of executing JavaScript; (3) the /ws/network/proxy endpoint is accessible from the browser's context, typically via localhost. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P) signals a network-reachable but conditionally complex attack - requiring victim interaction, a running SiYuan instance, and specific attack prerequisites (AT:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious webpage containing JavaScript that initiates a WebSocket connection to ws://127.0.0.1:[SiYuan-port]/ws/network/proxy; when a victim with SiYuan running visits this page, the origin check is bypassed and the attacker's script issues proxy directives through the victim's kernel process to reach internal hosts such as development servers, admin panels, or intranet services. Because the proxy operates within the victim's network context, it can reach services that are firewalled from the external internet. … |
| Remediation | Upgrade SiYuan to version 3.7.4 or later, which is the vendor-released patch that addresses the missing origin validation on the /ws/network/proxy WebSocket endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today