Siyuan
Monthly
Stored cross-site scripting in SiYuan through 3.8.4 lets an attacker inject malicious style values into heading attributes that the outline and bookmark docks render without escaping, so the payload executes as JavaScript inside SiYuan's Electron renderer - which runs with full system access, making this effectively an XSS-to-code-execution condition on the host rather than ordinary script execution in a sandboxed browser context. Delivery is either a crafted notebook that the victim imports or opens, or abuse of SiYuan's administrative endpoints (the latter implying authenticated access); the payload only fires when the victim surfaces the affected heading in the outline or bookmark dock, so user interaction is required (UI:A) and exploitation is not purely passive. No public exploit identified at time of analysis; the CVE carries a CVSS 4.0 base score of 8.6 and was independently assessed as CVSS 3.1 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting the notebook-import path being unauthenticated while the administrative-endpoint path requires credentials.
Stored cross-site scripting in SiYuan through 3.8.4 lets an attacker who can set a notebook name containing an HTML payload have that markup rendered unescaped when the Daily Note picker dialog is opened, executing JavaScript inside the Electron renderer where Node.js integration is available and escalating to operating system command execution. Exploitation is gated by two preconditions: the attacker must be able to create or inject a notebook carrying the payload (a shared or synced workspace, a server-mode multi-user deployment, or an imported malicious notebook), and the victim must open the picker; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, while the published CVSS 4.0 score of 8.6 carries PR:N/UI:A, so the two scorings disagree on whether prior privileges are needed. This is treated as a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the impact chain terminates in OS command execution rather than mere client-side script execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a purely local single-user instance that never ingests external notebooks has a materially smaller attack surface.
SQL injection in SiYuan versions before 3.8.3 allows unauthenticated remote readers, in deployments running publish/sharing mode, to execute arbitrary SQL against the read-write database through the getGraph endpoint and exfiltrate private data across notebooks. The CWE-89 flaw arises in graph.go's query2Stmt function, where tag values are concatenated raw into SQL string literals without escaping single quotes, and it can be reached via inline HTML span tags. The vendor released a fix in 3.8.3, and no public exploit code or CISA KEV confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score is 7.2 (High) with high confidentiality impact.
Cross-site scripting in the SiYuan desktop note-taking app before 3.8.4 allows an attacker who can dictate a document title - either by calling the rename API or by delivering a crafted notebook the victim opens - to inject markup that is rendered as HTML in the backlink dock tree and executed inside the Electron renderer. Because the default desktop build exposes Node's child_process to the renderer, successful script execution escalates from XSS to arbitrary command execution on the victim's machine; the CVSS 4.0 vector rates this 8.6 (PR:N, UI:A), and the independent assessment concurs that this is a genuinely high-priority issue rather than an inflated score. Exploitation still depends on user interaction (the victim must view the poisoned title in the backlink dock or import the malicious notebook), no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation; a vendor patch is available in 3.8.4.
Stored cross-site scripting in SiYuan notebook software before 3.8.4 lets an attacker who supplies a crafted .sy notebook file execute arbitrary script inside the Electron renderer, which in the default desktop build has Node.js child_process access and therefore escalates to host-level command execution. The flaw arises because bookmark labels read from imported notebook files are written into the dock tree HTML without escaping, so unescaped markup in a bookmark attribute is rendered as live DOM. No credentials are required (CVSS PR:N) and no public exploit code or CISA KEV entry has been identified at time of analysis, but the vector requires the victim to import or open the malicious notebook (UI:A/UI:R), making delivery dependent on social engineering; EPSS data was not supplied.
Path traversal in SiYuan's flashcard deck management API allows an authenticated administrator to delete arbitrary `.deck` and `.cards` files anywhere on the host filesystem. The `/api/riff/removeRiffDeck` endpoint accepts a `deckID` parameter without sanitizing traversal sequences, so a malicious or compromised admin account can reference files outside the designated workspace directory. The CVSS 4.0 score of 8.4 (PR:H) reflects that exploitation requires administrative credentials, but the subsequent-system integrity and availability impacts (SI:H/SA:H) confirm that damage extends beyond the SiYuan workspace itself. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in SiYuan's search asset preview feature allows authenticated workspace members to inject and execute arbitrary JavaScript in other users' browser sessions. All SiYuan releases before v3.8.2 are affected; the flaw stems from unescaped asset content passed directly to innerHTML during search preview rendering. Successful exploitation grants the attacker authenticated API access within the SiYuan origin, enabling workspace data exfiltration and content manipulation on behalf of the victim.
Stored cross-site scripting in SiYuan's Search Assets result list (all versions before 3.8.2) allows low-privilege authenticated attackers to plant JavaScript payloads inside asset filenames that execute in any user's browser session when that user performs an asset search. The CVSS 4.0 score of 8.4 (PR:L/UI:A) reflects the requirement for a valid account and victim interaction, but successful exploitation grants the attacker same-origin API access and full application state manipulation under the victim's identity. No active exploitation has been confirmed and no public POC is identified at time of analysis.
Stored cross-site scripting in SiYuan's Bazaar marketplace component (all versions before 3.8.2) allows an attacker to publish a package with a crafted iconURL containing JavaScript event handlers that execute in the authenticated user's SiYuan origin when Bazaar listing cards are rendered. The root flaw is unsanitized insertion of iconURL package metadata directly into HTML img src attributes, enabling injected event handlers such as onerror to fire arbitrary JavaScript within the victim's session. Once triggered, the injected script can make authenticated API requests and manipulate application state on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in SiYuan note-taking application before v3.8.2 allows an authenticated attacker to achieve same-origin JavaScript execution in a victim's browser session. Notebook template paths are persisted to storage and later reflected into HTML input value attributes without attribute-context encoding, enabling an attacker who can write a template path to inject JavaScript that executes when any user opens the affected notebook's configuration panel. Successful exploitation permits same-origin API requests and full application state manipulation, including access to notes, attachments, and configuration secrets. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Siyuan note-taking application before v3.8.2 leaks private block content to authenticated readers through two export/preview API endpoints that skip publish-access validation when resolving embedded block references. Any user holding reader-level credentials can craft requests to /api/export/preview or /api/lute/copyStdMarkdown referencing public documents whose embed queries target private, hidden, or publish-disabled blocks, receiving their full rendered content. No public exploit code or CISA KEV listing has been identified, but exploitation requires only reader authentication and standard HTTP tooling.
Read-only mode bypass in SiYuan ≤ 3.8.1 allows an authenticated administrator to submit arbitrary SQL against the blocks database via POST /api/search/fullTextSearchBlock (method=2), circumventing the workspace's --readonly=true protection that correctly blocks the dedicated /api/query/sql endpoint. The prior fix for CVE-2026-32767 added an admin-role gate but omitted the model.CheckReadonly and CheckReadonlyStatementInBox calls, leaving the SQL code path unguarded. Vendor-released patch available in v3.8.2; no public exploit identified at time of analysis.
SQL injection in SiYuan's fullTextSearchBlock endpoint (versions before v3.8.2) allows read-level database access to the entire blocks table by injecting UNION SELECT statements into the method=1 query parameter. The vulnerability bypasses publish-access controls, exposing document content and sensitive block attributes that the operator intended to keep private. No public exploit or CISA KEV listing is confirmed at time of analysis, but the straightforward UNION-based injection pattern and availability of a GitHub security advisory make reproduction low-effort.
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Unauthorized access to private attribute-view database contents in SiYuan before v3.8.2 is possible for any user holding a Publish reader role. The getAttributeViewKeys endpoint fails to enforce document-level access controls on hidden KeyValues, returning private cell data from rows bound to documents the requesting user cannot legitimately view. Exploitation requires only low-privilege authenticated access (PR:L per CVSS 4.0 vector); no public exploit or active KEV listing has been identified at time of analysis.
Unbounded memory consumption in SiYuan's request-concurrency middleware allows unauthenticated remote attackers to permanently exhaust process memory by flooding the application with unique request paths. The root cause is a mutex-entry map that grows without bound - each distinct URL path creates a new mutex entry that is never evicted, causing memory and synchronization overhead to accumulate indefinitely. All SiYuan deployments prior to v3.8.2 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion denial-of-service in SiYuan's publish-service Basic Auth throttle allows unauthenticated remote attackers to crash or degrade the service by submitting authentication requests with an unbounded number of unique invalid usernames. Because the throttle tracks per-username failure state in memory with no capacity limit or eviction policy, the in-memory tracking structure grows without bound until the process exhausts available heap. All SiYuan versions prior to v3.8.2 are affected; no active exploitation has been identified at time of analysis.
Path traversal via symlink following in SiYuan's reader-accessible file-read API allows authenticated low-privilege users to escape the workspace boundary and read arbitrary server-side files. Versions before v3.8.2 fail to resolve symlink targets before serving asset content, meaning a reader-role account can request a data/assets/ path that is a symlink pointing outside the workspace and receive the target file bytes. The impact is strictly confidentiality - no integrity or availability consequences - but sensitive server-side files (credentials, SSH keys, configuration) could be exfiltrated. No public exploit code or CISA KEV listing exists at time of analysis.
Memory exhaustion in SiYuan's publish-service Basic Auth handler allows authenticated users to repeatedly submit valid credentials, generating persistent session entries that accumulate without expiry or capacity limits, eventually crashing the process. All SiYuan versions before v3.8.2 are affected, as confirmed by vendor security advisory GHSA-f4vj-ppp2-5hg4. No active exploitation has been recorded in CISA KEV and no public proof-of-concept code is known, but the low barrier - only valid credentials required - means any account holder can trigger denial of service on demand.
Unauthenticated remote memory exhaustion in SiYuan before v3.8.2 allows any network-reachable attacker to degrade or crash the service by flooding the /api/system/uiproc endpoint with unique process identifiers. The endpoint retains each submitted identifier in memory without size bounds, rate limiting, or authentication checks, making the attack trivially automatable. No public exploit code or KEV status is confirmed at time of analysis, but the simplicity of exploitation via repeated HTTP requests requires no special tooling.
Path guard bypass in SiYuan's MCP file-access handler exposes the protected publishAccess.json configuration file to authenticated low-privileged attackers on Linux deployments. The handler enforces access restrictions using case-sensitive string matching, but Linux filesystems are themselves case-sensitive - meaning an attacker requesting a case-variant path such as PublishAccess.json bypasses the guard while the filesystem resolves it to the same protected file. All SiYuan versions before v3.8.2 are affected. No public exploit code or CISA KEV listing is identified at time of analysis.
Authorization bypass in SiYuan through 3.8.1 exposes private notebook content to low-privileged readers via the /api/file/getFile endpoint. Users assigned the reader role can circumvent the Visible:false notebook access control by directly requesting files with a known notebook identifier and file path, retrieving notebook metadata and internal configuration that the workspace owner intended to keep private. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but reader-role access is the only prerequisite for exploitation.
TLS private key disclosure in SiYuan <=3.8.1 allows any authenticated user - or any network client on default no-auth-code deployments - to exfiltrate the server's TLS private key (conf/key.pem) and CA private key (conf/ca.key) via a simple POST to /api/file/getFile. The root cause is a dual flaw: the IsForbiddenAbsPath() blocklist covers only conf/conf.json by exact match while leaving sibling key material unprotected, and the getFile handler unconditionally skips the blocklist for RoleAdministrator - a role granted to every authenticated user in v3.8.1. On TLS-enabled, network-exposed instances this enables retrospective decryption of captured HTTPS sessions and forgery of certificates already trusted by clients that imported SiYuan's CA. No public exploit identified at time of analysis; vendor-confirmed fix is available in v3.8.2.
SiYuan's full-text search logging mechanism writes admin API tokens in plaintext to an accessible log file when requests exceed internal timing thresholds, enabling authenticated low-privilege users to escalate to permanent administrative access. All self-hosted SiYuan instances before v3.8.2 are affected; because API tokens are passed as query parameters and the log file is retrievable via the built-in getFile endpoint, the privilege escalation path requires no additional exploitation steps beyond triggering a slow search and reading the file. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Vendor-released patch v3.8.2 resolves the issue.
Stored XSS in SiYuan before v3.8.2 enables authenticated users with upload access to bypass the asset extension blocklist by using file types such as .xht, .ehtml, .xsl, .xbl, or .rdf that browsers render as executable documents. When a victim opens or previews the malicious asset, embedded JavaScript runs in the SiYuan application context, allowing theft of API tokens and full workspace compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in v3.8.2.
Stored cross-site scripting in SiYuan before v3.8.1 lets an authenticated user plant HTML/script payloads in a block's name, alias, or memo field, which then execute in another user's session when that user views any document that references or displays the poisoned block via hint, backlink, or breadcrumb rendering. Because the malicious markup runs in the victim's authenticated context, an attacker can hijack sessions and act as the victim. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Stored cross-site scripting in SiYuan before v3.8.1 lets a low-privileged attacker persist HTML/script payloads in bazaar package names and notebook names, which the confirmDialog() function interpolates unescaped into innerHTML. The script executes in a victim's browser session when they uninstall a malicious package or unlock an encrypted notebook, enabling session-context takeover of the note-taking application. No public exploit identified at time of analysis and no active exploitation is recorded.
Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.
SiYuan before v3.8.1 exposes a DNS rebinding SSRF vulnerability in its http_request and web_fetch agent tools, allowing network-accessible attackers who can influence processed URLs to bypass the built-in SSRF IP-blocklist defense and reach cloud instance metadata services or internal network hosts. The guard-time-only DNS resolution creates a TOCTOU race: the SSRF check sees a legitimate public IP, but the actual TCP connection lands on 169.254.169.254 or another private address. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS 4.0 score of 8.4 reflects high downstream confidentiality risk for cloud-hosted deployments where metadata credentials are accessible.
Arbitrary file deletion in SiYuan before v3.7.4 allows authenticated administrators to recursively destroy any file or directory accessible to the SiYuan kernel process by supplying an unsanitized absolute path to the /api/search/removeTemplate endpoint, which passes the value directly to Go's os.RemoveAll. All SiYuan releases prior to v3.7.4 are confirmed affected per vendor advisory GHSA-w938-w7m4-qrj8. No public exploit or CISA KEV listing exists at time of analysis, but the high integrity and availability impact - including potential downstream filesystem destruction beyond the application - makes admin credential hygiene the critical control.
Stored cross-site-scripting-to-RCE in SiYuan (the open-source personal knowledge-management/note app) before v3.7.4 lets an attacker-crafted document execute arbitrary OS commands on a victim's machine. Document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated unescaped into the aria-label attribute of the file-tree 'move/link to' path-picker tooltip; a double quote breaks out of the attribute and injects an inline event handler. Because every SiYuan Electron window runs with nodeIntegration:true, contextIsolation:false and no CSP, the handler reaches require('child_process') and achieves command execution the moment the victim hovers the malicious entry. There is no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting escalating to arbitrary OS command execution affects the SiYuan personal knowledge-management application through version 3.7.3. Because the '((' block-reference autocomplete popup renders a candidate block's name, alias, and memo fields into HTML without escaping, an attacker who controls those metadata fields can plant a self-firing payload that runs the moment a victim types '((' and surfaces the crafted block; SiYuan's Electron shell runs with nodeIntegration enabled, contextIsolation disabled, and no CSP, so the injected script reaches require('child_process') and executes host commands. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the XSS-to-RCE chain is fully described by the VulnCheck advisory and vendor GHSA.
Publish-mode endpoint misconfiguration in SiYuan before v3.7.4 exposes operator-forbidden documents to anonymous remote visitors. Eight reader-facing API endpoints - covering search, backlinks, asset content, saved criteria, recent documents, graph, and tags - incorrectly apply the visibility access-control list rather than the disabled list, bypassing the intended publication restriction. Unauthenticated attackers can enumerate and read content that the SiYuan operator has explicitly marked as forbidden from publishing; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes private knowledge-base content to anonymous publish-mode readers through 17 insufficiently protected block API endpoints in kernel/api/block.go. Remote attackers without credentials can enumerate arbitrary block IDs to retrieve private text content, structural metadata, and block existence information across the entire workspace. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in v3.7.4 per GitHub Security Advisory GHSA-4vpg-gwqq-w44c.
Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.
Unthrottled brute-force against SiYuan's Publish Service Basic Auth allows remote unauthenticated attackers to enumerate passwords against named publish-viewer accounts and gain read access to published notes and notebooks. All SiYuan releases before 3.7.4 are affected wherever the Publish Service is enabled and network-accessible on its default TCP port 6808. No public exploit code has been identified at time of analysis, but the attack is trivially automatable using any standard HTTP client given the complete absence of rate limiting, per-account lockout, or exponential backoff in the vulnerable code path.
Cross-site WebSocket hijacking in SiYuan before 3.7.4 lets a remote unauthenticated attacker weaponize the victim's running SiYuan instance as a network proxy to arbitrary attacker-chosen targets. The /ws/network/proxy endpoint explicitly disables WebSocket origin validation by setting CheckOrigin to unconditionally return true, allowing malicious webpages to open unauthorized WebSocket connections through the victim's browser and issue proxy commands to the SiYuan kernel. No public exploit is confirmed in CISA KEV, but SSVC flags a POC exists; the CVSS 4.0 score is 7.1 and EPSS is 0.10%, indicating limited observed exploitation at time of analysis.
Local privilege escalation in SiYuan before 3.7.4 allows a low-privileged local attacker to execute arbitrary commands with administrator privileges by crafting a workspace directory whose path contains OS command metacharacters. When the victim triggers the Microsoft Defender exclusion workflow within SiYuan and approves the resulting UAC prompt, the application passes the unsanitized path to the elevated elevator.exe helper process, enabling command injection at administrator level. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.6 reflects the full-system compromise potential once the attack preconditions are met.
Stored cross-site scripting in SiYuan before v3.7.4 lets an authenticated user upload an HTML file through the asset-serving endpoint, which the server returns without Content-Disposition or X-Content-Type-Options headers, so the browser renders it inline instead of downloading it. When the workspace owner clicks the malicious asset link, the injected script runs in the app's origin with full kernel API access, enabling account and data compromise. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before 3.7.4 exposes Go net/http/pprof debug endpoints (heap, goroutine, and related dumps) to any remote client whenever the application is not started with --mode set exactly to prod. Because non-prod is the effective default, attackers can query /debug/pprof/heap to scrape live process memory and recover secrets such as the AccessAuthCode and configured AI provider API keys. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Arbitrary file read and deletion in SiYuan kernel before v3.7.4 arises from an unvalidated id parameter in the database_clean MCP tool, letting an authenticated MCP client traverse the filesystem to copy any process-readable file into the history directory and then delete the original. This is the MCP-facing twin of a flaw previously fixed on the HTTP API path (GHSA-7hm9-v7vf-7g4w), meaning a known-bad code pattern survived in a second caller. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and not listed in CISA KEV.
Unthrottled API-token brute force in SiYuan kernel before 3.7.4 lets an unauthenticated remote attacker repeatedly guess the Conf.Api.Token because the CheckAuth() middleware bypasses the app's CAPTCHA/lockout controls (NeedCaptcha/WrongAuthCount). Reported by VulnCheck and fixed in 3.7.4, a successful guess yields full RoleAdministrator access, permitting arbitrary file operations and SQL queries. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the CVSS 4.0 base score is 9.3.
SQL injection in SiYuan's backlink/mention search (kernel/model/backlink.go) lets unauthenticated attackers execute arbitrary SQL against the self-hosted note-taking application through v3.7.2. Because the search routine escapes only double quotes and leaves single quotes intact, a crafted keyword or malicious stored block metadata breaks out of the SQL string literal on the primary read-write siyuan.db handle, enabling cross-notebook read and write. VulnCheck reports the flaw (CVSS 4.0 base 9.9); no public exploit identified at time of analysis, and it is fixed in v3.7.4.
Unauthorized disclosure of private content in SiYuan (siyuan-note) versions before v3.7.4 lets anonymous, unauthenticated clients subscribe to the WebSocket broadcast channel on the publish surface and receive real-time editing events for every document, including password-protected and explicitly forbidden ones. Reported by VulnCheck and documented in the vendor's GHSA advisory, the flaw is a missing authorization (CWE-862) check on broadcast sessions rather than a memory-corruption bug. No public exploit identified at time of analysis, but the trivial network-only access path and 9.2 CVSS 4.0 score make this a high-priority confidentiality issue for any exposed publish deployment.
Missing authorization in SiYuan's /api/av/getAttributeViewSearchTarget endpoint allows an anonymous reader to retrieve database (attribute view) row content that publish-access filtering should hide. The affected route was added by commit 9b8e8956f and exists only in the development branch - it is absent from v3.7.3 and master and was fixed in v3.7.4, so no released stable version is affected. There is no public exploit identified at time of analysis and it is not in CISA KEV; despite the 9.2 CVSS the real-world exposure is limited to self-built development instances.
Authentication bypass in SiYuan's kernel CheckAuth function unconditionally grants administrator privileges (RoleAdministrator) to any HTTP request whose RemoteAddr is 127.0.0.1, affecting a specific set of endpoints including /api/system/exit, /assets/*, and /export/*, even when an access auth code is explicitly configured. All versions up to and including v3.7.2 are affected; v3.7.4 contains the vendor-released patch. The fixed-port reverse proxy forwards requests to the kernel over loopback without injecting authentication tokens or configuring trusted proxy headers, creating a theoretical remote unauthenticated attack path if the proxy is bound to a network-accessible interface - though per the advisory this remote scenario was established only by code inspection and was not reproduced end-to-end. No public exploit code exists and this CVE is not listed in the CISA KEV catalog.
Second-order SQL injection in SiYuan's attribute-view template columns allows a remote attacker to execute arbitrary SQL against a victim's local kernel database by distributing a crafted document or package. All SiYuan releases before v3.7.4 are affected; the `queryBlocks` function processes attacker-controlled template column data through raw string substitution rather than parameterized queries, granting full read and write access across all notebooks upon import and render. No public exploit has been identified at time of analysis, but the attack is practically feasible in any community or collaborative context where SiYuan packages are exchanged.
Information disclosure in SiYuan, a self-hosted block-based personal knowledge management app, lets anonymous, unauthenticated network callers read the contents of password-protected documents. Versions before v3.7.4 skip the publish-password tier check in the getGraph and getLocalGraph endpoints, so an attacker who reaches the instance can retrieve block-level text and the full reference/link topology of protected notes without ever supplying the publish password. Reported by VulnCheck and fixed in v3.7.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SiYuan's publish mode in versions before v3.7.4 leaks Argon2id key-derivation material - including salt, cost parameters, password verifiers, and wrapped notebook data keys - through unauthenticated HTTP endpoints, enabling unlimited offline master-password cracking. Remote unauthenticated attackers who can reach a publish-mode SiYuan instance can retrieve all inputs needed to run offline Argon2id cracking campaigns with no server-side rate limiting. No public exploit has been identified at time of analysis, but the attack requires only standard HTTP requests once the target is located.
Sensitive data disclosure in SiYuan note-taking application before v3.7.4 lets anonymous readers of a published workspace pull Relation and Rollup cell contents out of hidden or password-protected databases. Because renderAttributeView does not re-check authorization on the related database, an unauthenticated visitor can request a published attribute view that references a restricted database and read its protected values, and can bypass row-level filtering entirely when the first column is a non-block type. Reported by VulnCheck with a CVSS 4.0 base score of 9.2; no public exploit identified at time of analysis.
Unauthorized cross-document content disclosure in SiYuan note-taking software before v3.7.4 allows remote attackers to read protected notes without credentials. The getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints resolve embed queries inside published blocks without re-checking publish-access controls, so an attacker who reaches a published SiYuan workspace can pull back content from password-protected, hidden, or forbidden documents. No public exploit identified at time of analysis, but VulnCheck rates it CVSS 9.2 (CVSS 4.0) and it constitutes an authentication/authorization bypass.
Credential disclosure in SiYuan note-taking software before v3.7.4 lets unauthenticated remote attackers read the session cookie signing key (CookieKey) from the /api/system/getConf endpoint when an instance runs in publish mode. With that key an attacker can mint valid signed session cookies, impersonate any user, and escalate to administrative control of the workspace. Reported by VulnCheck with a vendor security advisory (GHSA-34fj-mwm6-fjfg); no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Sensitive credential exposure in SiYuan (self-hosted note-taking app) before v3.7.4 allows anonymous or publish-reader users to query the /api/system/getConf endpoint and retrieve unmasked secrets, including the session-cookie signing key, the OS username (leaked via the pandoc path), and encrypted-notebook key material. With the signing key, attackers forge and tamper with session cookies to impersonate any user, and on instances that have not configured an access-auth code they can escalate to full administrator privileges. No public exploit identified at time of analysis, but the flaw is remotely reachable without authentication against default configurations.
Anonymous information disclosure in SiYuan before v3.7.4 lets unauthenticated remote readers retrieve fully decrypted content from encrypted notebooks. Because the publish API treats encrypted notebooks as publicly accessible by default, any anonymous visitor can enumerate and read documents from an unlocked encrypted notebook without authentication or knowledge of the encryption key. Reported by VulnCheck and rated CVSS 4.0 9.2; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Path traversal in SiYuan's attribute-view read endpoints allows low-privileged users to read arbitrary JSON files outside the intended storage directory on versions before v3.7.3. The avID parameter is unsanitized across all code branches, enabling RoleReader-level authenticated users - or anonymous clients when publish authentication is disabled - to exfiltrate cross-scope database content stored as JSON on the server filesystem. No public exploit has been identified at time of analysis, and a vendor patch is available in v3.7.3.
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitrary SQL through the unescaped keyword parameter of the /api/filetree/searchDocs endpoint. Because the query runs on a read-write SQLite handle that permits stacked statements, an attacker can both read and tamper with content across every cleartext notebook, and the endpoint is reachable unauthenticated when publish mode runs with Publish.Auth.Enable=false. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and the CVSS 4.0 score is 9.9.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements verbatim to the primary read-write siyuan.db handle via the /api/search/searchEmbedBlock endpoint. Because the endpoint is gated only by CheckAuth, it is reachable with the low-privilege publish RoleReader token - and by fully anonymous users when publish authentication is disabled - and the driver's support for stacked statements allows both reading and modifying content across all opened cleartext notebooks. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a critical 9.9 CVSS 4.0 score; it is fixed in v3.7.3.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish RoleReader tokens execute arbitrary SQL against the read-write asset-content database in all versions before v3.7.3. Because the endpoint is reachable without authentication and the database is writable, attackers can read, alter, or delete data across notebooks - not merely exfiltrate it. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.9.
Information disclosure in SiYuan (a personal knowledge-management/note-taking application) before v3.7.3 lets anonymous readers or low-privilege publish RoleReader tokens read the full rendered content of documents that were explicitly marked publish-disabled. The getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints return rendered block DOM without enforcing publish-access checks, so supplying a target heading block ID leaks restricted content. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Broken access control in SiYuan versions before 3.7.3 lets publish-mode readers - including anonymous users when publish Basic Auth is disabled - retrieve the rendered content of publish-forbidden documents by calling the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc endpoints directly with a target document ID. Although the corresponding backlink list endpoints correctly filter publish-forbidden documents, these two content endpoints are gated only by CheckAuth and omit the publish-access filter, exposing DOM content and a reference-existence oracle. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Authentication bypass in SiYuan (self-hosted knowledge-management/note-taking app) versions before v3.7.3 allows anonymous readers in publish mode to exfiltrate the full content of password-protected documents. While the primary getDoc endpoint enforces the publish-mode password, sibling content-returning endpoints (getHeadingChildrenDOM, the getHeading*Transaction family, and getBacklinkDoc) omit that check, so an attacker who harvests internal block IDs from reader-accessible endpoints can pull protected content directly. VulnCheck reported the issue and a vendor patch (v3.7.3) is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote administrator takeover in SiYuan before v3.7.2 via missing authorization on the /mcp kernel endpoint. When the Publish server is in anonymous mode, a remote attacker can invoke 31 MCP tools—including full file-system read, write, and delete—to exfiltrate secrets from conf/conf.json and plant a malicious plugin that runs with elevated desktop privileges. While no active exploitation has been confirmed by CISA KEV, detailed exploit information is publicly available, and the vulnerability carries a maximum CVSS severity.
Cross-site scripting escalating to remote code execution in SiYuan (open-source personal knowledge management) before 3.7.1 lets an attacker embed a crafted asset link whose path contains a double quote, breaking out of an image src attribute in Asset.render to inject an event handler. Because SiYuan runs in an Electron renderer with OS-level capabilities, the injected JavaScript can execute arbitrary operating-system commands on the victim's machine once the malicious asset is opened. No public exploit identified at time of analysis, and it is not listed in CISA KEV; user interaction is required to trigger the flaw.
Authenticated path traversal in SiYuan personal knowledge management system (versions prior to 3.7.1) lets a low-privileged user read arbitrary workspace files by abusing the /snippets/*filepath handler. Because serveSnippets in kernel/server/serve.go single-decodes the request path and joins it to the snippets directory without containment or sensitive-file checks, a request like /snippets/%2e%2e/%2e%2e/conf/conf.json returns workspace secrets and the document database. No public exploit identified at time of analysis, though the fixing commit publicly reveals the vulnerable code path.
Stored cross-site scripting in SiYuan before 3.7.1 escalates to OS command execution inside the Electron desktop renderer because the bundled Lute Markdown/HTML engine sanitizes content but fails to block dangerous javascript schemes in form action and SVG xlink:href attributes. An attacker who plants crafted content that a victim later opens via document export-preview or a Bazaar package README render can run arbitrary code on the victim's machine. There is no public exploit identified at time of analysis, and it is not on CISA KEV; the CVSS 4.0 base score is 8.6.
SQL injection in SiYuan's block-search endpoint (POST /api/search/fullTextSearchBlock) before version 3.7.1 lets an unauthenticated publish-mode visitor read documents they should not see. The endpoint concatenates attacker-controlled `paths` values directly into SQL predicates used by its non-SQL search modes, enabling a UNION SELECT that projects rows from hidden documents by spoofing an allowed visible box and path. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; CVSS is 7.5 reflecting confidentiality-only impact.
Stored cross-site scripting leading to OS command execution in SiYuan, an open-source personal knowledge management system, affects all desktop client versions prior to 3.7.0. Untrusted marketplace package metadata (name, version, author, description) is serialized via JSON.stringify() into a single-quoted data-obj HTML attribute without escaping single quotes or angle brackets, so a package name containing a single quote breaks out of the attribute and injects arbitrary HTML; because the Electron BrowserWindow runs with nodeIntegration:true and contextIsolation:false, the DOM XSS escalates to arbitrary command execution on the host. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-x88j-wgpr-h22x) notes this is the same root cause and impact as a prior advisory, reached through a sibling sink the earlier patch missed.
Arbitrary command execution in the SiYuan Electron desktop client (versions prior to 3.7.0) allows a remote attacker to run OS commands on a victim's machine when they merely view a malicious Bazaar marketplace package's README. The root cause is that Lute's HTML sanitizer fails to strip <iframe> elements, which combine with the Electron client's permissive security settings (e.g. node integration / relaxed sandboxing) to escalate stored XSS into full code execution; notably no package installation is required, only viewing the package details. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (High) reflects high confidentiality, integrity, and availability impact.
Stored cross-site scripting in SiYuan's Attribute View (database) asset cell renderer escalates to remote code execution on the Electron desktop client for all versions prior to 3.7.0. An attacker who can persist crafted content into a database asset cell has malicious JavaScript executed in the privileged Electron context, breaking out to the host operating system; the issue carries a 9.9 CVSS and is fixed in 3.7.0. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Stored cross-site scripting in SiYuan's attribute-view (database) cell renderer, affecting all versions prior to 3.7.0, lets a low-privileged attacker with write access to a synced workspace plant a persistent payload that runs arbitrary JavaScript when a victim opens the block-attribute panel. The genAVValueHTML function interpolates cell content raw in its text, url, phone, and mAsset branches and the Go kernel never escapes the value on input, so the malicious row survives sync byte-for-byte and fires on every device that renders it; on the Electron desktop client (nodeIntegration:true) the XSS escalates to host remote code execution via require('child_process'). CVSS is rated 9.9; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in SiYuan personal knowledge management system before 3.7.0 allows a third-party Bazaar package author to execute JavaScript in an Administrator's authenticated workspace origin. The lute sanitizer used by renderPackageREADME relies on a stale event-handler blocklist that omits modern DOM event attributes (onpointerover, onpointerdown, onauxclick, onbeforetoggle, onfocusin, onanimationstart, ontransitionend), and the rendered README HTML is injected via innerHTML with no client-side DOMPurify and no CSP/X-Frame-Options/X-Content-Type-Options headers. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but successful exploitation yields full control of the victim's workspace.
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chrome/Chromium browser extension obtain RoleAdministrator access to the local kernel HTTP server at 127.0.0.1:6806. Because the kernel unconditionally trusts all chrome-extension:// origins and desktop installs ship with an empty AccessAuthCode by default, a malicious or supply-chain-compromised extension can issue fully authenticated admin API calls with no further authentication, enabling data exfiltration, stored XSS injection, and configuration tampering. Publicly available exploit code exists; there is no public exploit identified as actively exploited.
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a synced workspace plant a CSS snippet whose '</style>' sequence breaks out of the surrounding <style> tag when renderSnippet() interpolates it via insertAdjacentHTML, running arbitrary JavaScript in the renderer. On Electron desktop builds the renderer runs with nodeIntegration:true, so the injected handler can reach require('child_process') and escalate the XSS to full host remote code execution. The payload syncs through the workspace repository and fires automatically on every device that pulls, and it bypasses the user's enabledJS=off setting; no public exploit or CISA KEV listing is identified at time of analysis.
Arbitrary file disclosure in SiYuan personal knowledge management system before 3.7.0 lets an unauthenticated remote attacker read any file inside the workspace directory through its publish-mode HTTP endpoint (default port 6808). The flaw is an incomplete fix for CVE-2026-41894: the earlier patch sanitized the /export/ route but left the identical double-URL-encoding path traversal in the /assets/*path route, exposing conf/conf.json (AccessAuthCode SHA256 hash, API token, sync keys), the temp SQLite databases, and siyuan.log. Publicly available exploit code exists; no public active exploitation has been confirmed.
Remote code execution in SiYuan note-taking application (before v3.6.1) allows any malicious Bazaar marketplace package author to compromise users via unsanitized HTML rendering of package displayName, description, and README content. Because the Electron renderer is configured with nodeIntegration:true and contextIsolation:false, injected JavaScript pivots directly to arbitrary OS command execution. No public exploit identified at time of analysis, but VulnCheck published a detailed technical advisory documenting both zero-click (metadata) and one-click (README) vectors.
Stored cross-site scripting in SiYuan's Bazaar marketplace (versions 2.1.12 through 3.6.x) enables arbitrary code execution on the host system. The vulnerability stems from unescaped package author metadata rendering, which when exploited through a malicious marketplace package, allows attackers to leverage SiYuan's insecure Electron configuration (nodeIntegration enabled, contextIsolation disabled) to execute Node.js APIs and OS-level commands. No public exploit or active exploitation confirmed at time of analysis. CVSS 8.3 with high attack complexity and required user interaction suggests real-world exploitation depends on convincing users to view crafted marketplace entries.
Directory traversal in SiYuan personal knowledge management system allows authenticated attackers to read arbitrary workspace files via double URL encoding bypass. The vulnerability stems from an incomplete fix for CVE-2026-30869 that added only denylist validation without removing a redundant url.PathUnescape() call in serveExport(). Attackers can use %252e%252e encoding to access sensitive files including the complete SQLite database (siyuan.db), kernel logs, and all user documents. EPSS data not available for this recent CVE; publicly available exploit code exists (GitHub commit demonstrates exploitation technique).
Authenticated local users can execute arbitrary code on Windows, macOS, and Linux via HTML injection in SiYuan desktop notification messages through version 3.6.4. The Electron-based desktop application mishandles notification rendering with unsafe settings (nodeIntegration enabled, contextIsolation disabled, webSecurity disabled), escalating XSS to full system compromise. Vendor-released patch available in version 3.6.5. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Stored cross-site scripting escalating to remote code execution in SiYuan (b3log) versions 3.6.3 and below, where Mermaid diagrams render with securityLevel 'loose' and inject SVG via innerHTML, letting javascript: URLs in Mermaid code blocks survive into the DOM. On Electron desktop builds — created with nodeIntegration enabled and contextIsolation disabled — a victim opening a note with a malicious Mermaid block and clicking the diagram node triggers arbitrary code execution. Publicly available exploit code exists (SSVC 'poc'); not listed in CISA KEV, and EPSS is very low at 0.05%.
Arbitrary server-side file deletion in SiYuan (b3log/SiYuan) versions 3.6.3 and prior lets a low-privileged actor with access to the /api/av/removeUnusedAttributeView endpoint - such as a Reader-role or publish context - supply an id parameter containing ../ sequences to escape the storage/av directory and delete any .json file on the server, including conf/conf.json and workspace metadata. The GitHub Security Advisory (GHSA-vw86-c94w-v3x4) includes step-by-step reproduction, so publicly available exploit code exists, but there is no public exploit identified as weaponized and SSVC exploitation status is 'none'; EPSS is low at 0.06%. Fixed in version 3.6.4.
NTLM credential theft in SiYuan personal knowledge management system (prior to 3.6.4) allows remote attackers to capture Windows user password hashes without authentication or user interaction. Misconfigured Mermaid.js rendering with securityLevel:loose permits unsanitized <img> tags within SVG foreignObject blocks. Protocol-relative URLs in malicious Mermaid diagrams trigger automatic SMB authentication on Windows, transmitting NTLMv2 hashes to attacker-controlled servers when victims open compromised notes. Electron client processes the SVG via innerHTML without secondary sanitization, enabling SSRF to UNC paths.
Remote code execution in SiYuan desktop client (Electron-based) versions prior to 3.6.4 allows authenticated attackers to execute arbitrary code on victim systems via malicious notes propagated through workspace sync. Stored XSS in table caption fields escalates to RCE due to nodeIntegration enabled and contextIsolation disabled in Electron renderer. CVSS 9.0 (Critical) with scope change indicates escape from browser context. No active exploitation confirmed (not in CISA KEV). EPSS score 0.14% suggests low current exploitation probability. Vendor-released patch: version 3.6.4.
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers to execute arbitrary JavaScript via the unauthenticated /api/icon/getDynamicIcon endpoint by bypassing SVG sanitization using XML namespace-prefixed element names. The vulnerability exploits a parser inconsistency where Go's HTML5 parser treats 'x:script' as a distinct tag while browsers' XML parsers resolve the namespace prefix to execute the script. Publicly available exploit code exists (GitHub issue #17246 documents the bypass technique), though no CISA KEV listing indicates mass exploitation campaigns at time of analysis.
Stored cross-site scripting (XSS) in SiYuan personal knowledge management system versions prior to 3.6.2 escalates to remote code execution in the Electron desktop client. Attackers craft malicious .sy.zip import files containing HTML entities mixed with raw special characters that bypass server-side attribute escaping, injecting event handlers into imported notes. When victims open the compromised note in the Electron client, injected JavaScript executes with full Node/Electron API access, enabling arbitrary code execution. CVSS 8.6 (High) with local attack vector requiring user interaction; no public exploit identified at time of analysis.
Unauthenticated information disclosure in SiYuan personal knowledge management system versions before 3.6.2 allows remote attackers to retrieve confidential content from password-protected documents via the publish service's bookmark API endpoint. The vulnerability bypasses document-level access controls by treating nil authentication contexts as authorized during bookmark filtering, exposing any bookmarked blocks without password verification. CVSS 7.5 (High) with network-based exploitation requiring no privileges or user interaction; no public exploit identified at time of analysis, though the security advisory provides detailed technical disclosure.
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to execute arbitrary code with full operating system privileges through CORS misconfiguration. A malicious website can inject JavaScript into the Electron-based application's Node.js context via the permissive API (Access-Control-Allow-Origin: * with Access-Control-Allow-Private-Network: true), which executes with OS-level access when the user next opens SiYuan's interface. No public exploit identified at time of analysis, though CVSS 9.6 (Critical) reflects network-accessible attack vector with low complexity requiring only user interaction (visiting malicious site while SiYuan runs). EPSS data not provided, but the combination of Electron framework exploitation, RCE impact, and trivial attack complexity suggests elevated real-world risk for desktop users.
Stored cross-site scripting (XSS) in SiYuan personal knowledge management system escalates to arbitrary operating system command execution on desktop clients. Authenticated attackers with low privileges can inject malicious URLs into Attribute View asset fields that execute JavaScript when victims view Gallery or Kanban layouts with "Cover From -> Asset Field" enabled. The Electron desktop client's configuration (nodeIntegration enabled, contextIsolation disabled) allows the XSS payload to break sandbox boundaries and execute arbitrary commands under the victim's OS account. CVSS 9.0 (Critical) with network attack vector, low complexity, and cross-scope impact. Vendor-released patch: version 3.6.2. No public exploit identified at time of analysis, though technical details are disclosed in GitHub advisory GHSA-rx4h-526q-4458.
SiYuan personal knowledge management system contains a cross-site scripting (XSS) vulnerability in versions 3.6.0 and below. An unauthenticated attacker can exploit the /api/icon/getDynamicIcon endpoint by crafting a malicious URL that bypasses SVG sanitization filters, allowing arbitrary JavaScript execution when a victim clicks an injected link within the rendered SVG. The CVSS score of 9.3 indicates critical severity, though exploitation requires user interaction (clicking a malicious link) and the attack complexity is low.
SiYuan personal knowledge management system versions 3.6.0 and below contain a path traversal vulnerability that allows authenticated attackers to exfiltrate arbitrary readable files from the system. An attacker with low-level privileges can exploit the /api/lute/html2BlockDOM endpoint to copy sensitive files to the workspace assets directory via malicious file:// links in pasted HTML, then retrieve them through the authenticated GET /assets/ endpoint. This is a critical vulnerability with a CVSS score of 9.9 due to its potential for high confidentiality impact and scope change, though no active exploitation (KEV) or public proof-of-concept has been documented.
SiYuan knowledge management system versions 3.6.0 and below allow unauthenticated WebSocket connections to the /ws endpoint via specific URL parameters, enabling attackers to bypass authentication and receive real-time server push events. An attacker can exploit this by connecting from a malicious website to monitor a victim's local SiYuan instance and exfiltrate sensitive metadata including document titles, notebook names, file paths, and user activity without the victim's knowledge. No patch is currently available for this high-severity information disclosure vulnerability.
Stored cross-site scripting in SiYuan through 3.8.4 lets an attacker inject malicious style values into heading attributes that the outline and bookmark docks render without escaping, so the payload executes as JavaScript inside SiYuan's Electron renderer - which runs with full system access, making this effectively an XSS-to-code-execution condition on the host rather than ordinary script execution in a sandboxed browser context. Delivery is either a crafted notebook that the victim imports or opens, or abuse of SiYuan's administrative endpoints (the latter implying authenticated access); the payload only fires when the victim surfaces the affected heading in the outline or bookmark dock, so user interaction is required (UI:A) and exploitation is not purely passive. No public exploit identified at time of analysis; the CVE carries a CVSS 4.0 base score of 8.6 and was independently assessed as CVSS 3.1 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting the notebook-import path being unauthenticated while the administrative-endpoint path requires credentials.
Stored cross-site scripting in SiYuan through 3.8.4 lets an attacker who can set a notebook name containing an HTML payload have that markup rendered unescaped when the Daily Note picker dialog is opened, executing JavaScript inside the Electron renderer where Node.js integration is available and escalating to operating system command execution. Exploitation is gated by two preconditions: the attacker must be able to create or inject a notebook carrying the payload (a shared or synced workspace, a server-mode multi-user deployment, or an imported malicious notebook), and the victim must open the picker; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, while the published CVSS 4.0 score of 8.6 carries PR:N/UI:A, so the two scorings disagree on whether prior privileges are needed. This is treated as a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the impact chain terminates in OS command execution rather than mere client-side script execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a purely local single-user instance that never ingests external notebooks has a materially smaller attack surface.
SQL injection in SiYuan versions before 3.8.3 allows unauthenticated remote readers, in deployments running publish/sharing mode, to execute arbitrary SQL against the read-write database through the getGraph endpoint and exfiltrate private data across notebooks. The CWE-89 flaw arises in graph.go's query2Stmt function, where tag values are concatenated raw into SQL string literals without escaping single quotes, and it can be reached via inline HTML span tags. The vendor released a fix in 3.8.3, and no public exploit code or CISA KEV confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score is 7.2 (High) with high confidentiality impact.
Cross-site scripting in the SiYuan desktop note-taking app before 3.8.4 allows an attacker who can dictate a document title - either by calling the rename API or by delivering a crafted notebook the victim opens - to inject markup that is rendered as HTML in the backlink dock tree and executed inside the Electron renderer. Because the default desktop build exposes Node's child_process to the renderer, successful script execution escalates from XSS to arbitrary command execution on the victim's machine; the CVSS 4.0 vector rates this 8.6 (PR:N, UI:A), and the independent assessment concurs that this is a genuinely high-priority issue rather than an inflated score. Exploitation still depends on user interaction (the victim must view the poisoned title in the backlink dock or import the malicious notebook), no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation; a vendor patch is available in 3.8.4.
Stored cross-site scripting in SiYuan notebook software before 3.8.4 lets an attacker who supplies a crafted .sy notebook file execute arbitrary script inside the Electron renderer, which in the default desktop build has Node.js child_process access and therefore escalates to host-level command execution. The flaw arises because bookmark labels read from imported notebook files are written into the dock tree HTML without escaping, so unescaped markup in a bookmark attribute is rendered as live DOM. No credentials are required (CVSS PR:N) and no public exploit code or CISA KEV entry has been identified at time of analysis, but the vector requires the victim to import or open the malicious notebook (UI:A/UI:R), making delivery dependent on social engineering; EPSS data was not supplied.
Path traversal in SiYuan's flashcard deck management API allows an authenticated administrator to delete arbitrary `.deck` and `.cards` files anywhere on the host filesystem. The `/api/riff/removeRiffDeck` endpoint accepts a `deckID` parameter without sanitizing traversal sequences, so a malicious or compromised admin account can reference files outside the designated workspace directory. The CVSS 4.0 score of 8.4 (PR:H) reflects that exploitation requires administrative credentials, but the subsequent-system integrity and availability impacts (SI:H/SA:H) confirm that damage extends beyond the SiYuan workspace itself. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in SiYuan's search asset preview feature allows authenticated workspace members to inject and execute arbitrary JavaScript in other users' browser sessions. All SiYuan releases before v3.8.2 are affected; the flaw stems from unescaped asset content passed directly to innerHTML during search preview rendering. Successful exploitation grants the attacker authenticated API access within the SiYuan origin, enabling workspace data exfiltration and content manipulation on behalf of the victim.
Stored cross-site scripting in SiYuan's Search Assets result list (all versions before 3.8.2) allows low-privilege authenticated attackers to plant JavaScript payloads inside asset filenames that execute in any user's browser session when that user performs an asset search. The CVSS 4.0 score of 8.4 (PR:L/UI:A) reflects the requirement for a valid account and victim interaction, but successful exploitation grants the attacker same-origin API access and full application state manipulation under the victim's identity. No active exploitation has been confirmed and no public POC is identified at time of analysis.
Stored cross-site scripting in SiYuan's Bazaar marketplace component (all versions before 3.8.2) allows an attacker to publish a package with a crafted iconURL containing JavaScript event handlers that execute in the authenticated user's SiYuan origin when Bazaar listing cards are rendered. The root flaw is unsanitized insertion of iconURL package metadata directly into HTML img src attributes, enabling injected event handlers such as onerror to fire arbitrary JavaScript within the victim's session. Once triggered, the injected script can make authenticated API requests and manipulate application state on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in SiYuan note-taking application before v3.8.2 allows an authenticated attacker to achieve same-origin JavaScript execution in a victim's browser session. Notebook template paths are persisted to storage and later reflected into HTML input value attributes without attribute-context encoding, enabling an attacker who can write a template path to inject JavaScript that executes when any user opens the affected notebook's configuration panel. Successful exploitation permits same-origin API requests and full application state manipulation, including access to notes, attachments, and configuration secrets. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Siyuan note-taking application before v3.8.2 leaks private block content to authenticated readers through two export/preview API endpoints that skip publish-access validation when resolving embedded block references. Any user holding reader-level credentials can craft requests to /api/export/preview or /api/lute/copyStdMarkdown referencing public documents whose embed queries target private, hidden, or publish-disabled blocks, receiving their full rendered content. No public exploit code or CISA KEV listing has been identified, but exploitation requires only reader authentication and standard HTTP tooling.
Read-only mode bypass in SiYuan ≤ 3.8.1 allows an authenticated administrator to submit arbitrary SQL against the blocks database via POST /api/search/fullTextSearchBlock (method=2), circumventing the workspace's --readonly=true protection that correctly blocks the dedicated /api/query/sql endpoint. The prior fix for CVE-2026-32767 added an admin-role gate but omitted the model.CheckReadonly and CheckReadonlyStatementInBox calls, leaving the SQL code path unguarded. Vendor-released patch available in v3.8.2; no public exploit identified at time of analysis.
SQL injection in SiYuan's fullTextSearchBlock endpoint (versions before v3.8.2) allows read-level database access to the entire blocks table by injecting UNION SELECT statements into the method=1 query parameter. The vulnerability bypasses publish-access controls, exposing document content and sensitive block attributes that the operator intended to keep private. No public exploit or CISA KEV listing is confirmed at time of analysis, but the straightforward UNION-based injection pattern and availability of a GitHub security advisory make reproduction low-effort.
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Unauthorized access to private attribute-view database contents in SiYuan before v3.8.2 is possible for any user holding a Publish reader role. The getAttributeViewKeys endpoint fails to enforce document-level access controls on hidden KeyValues, returning private cell data from rows bound to documents the requesting user cannot legitimately view. Exploitation requires only low-privilege authenticated access (PR:L per CVSS 4.0 vector); no public exploit or active KEV listing has been identified at time of analysis.
Unbounded memory consumption in SiYuan's request-concurrency middleware allows unauthenticated remote attackers to permanently exhaust process memory by flooding the application with unique request paths. The root cause is a mutex-entry map that grows without bound - each distinct URL path creates a new mutex entry that is never evicted, causing memory and synchronization overhead to accumulate indefinitely. All SiYuan deployments prior to v3.8.2 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion denial-of-service in SiYuan's publish-service Basic Auth throttle allows unauthenticated remote attackers to crash or degrade the service by submitting authentication requests with an unbounded number of unique invalid usernames. Because the throttle tracks per-username failure state in memory with no capacity limit or eviction policy, the in-memory tracking structure grows without bound until the process exhausts available heap. All SiYuan versions prior to v3.8.2 are affected; no active exploitation has been identified at time of analysis.
Path traversal via symlink following in SiYuan's reader-accessible file-read API allows authenticated low-privilege users to escape the workspace boundary and read arbitrary server-side files. Versions before v3.8.2 fail to resolve symlink targets before serving asset content, meaning a reader-role account can request a data/assets/ path that is a symlink pointing outside the workspace and receive the target file bytes. The impact is strictly confidentiality - no integrity or availability consequences - but sensitive server-side files (credentials, SSH keys, configuration) could be exfiltrated. No public exploit code or CISA KEV listing exists at time of analysis.
Memory exhaustion in SiYuan's publish-service Basic Auth handler allows authenticated users to repeatedly submit valid credentials, generating persistent session entries that accumulate without expiry or capacity limits, eventually crashing the process. All SiYuan versions before v3.8.2 are affected, as confirmed by vendor security advisory GHSA-f4vj-ppp2-5hg4. No active exploitation has been recorded in CISA KEV and no public proof-of-concept code is known, but the low barrier - only valid credentials required - means any account holder can trigger denial of service on demand.
Unauthenticated remote memory exhaustion in SiYuan before v3.8.2 allows any network-reachable attacker to degrade or crash the service by flooding the /api/system/uiproc endpoint with unique process identifiers. The endpoint retains each submitted identifier in memory without size bounds, rate limiting, or authentication checks, making the attack trivially automatable. No public exploit code or KEV status is confirmed at time of analysis, but the simplicity of exploitation via repeated HTTP requests requires no special tooling.
Path guard bypass in SiYuan's MCP file-access handler exposes the protected publishAccess.json configuration file to authenticated low-privileged attackers on Linux deployments. The handler enforces access restrictions using case-sensitive string matching, but Linux filesystems are themselves case-sensitive - meaning an attacker requesting a case-variant path such as PublishAccess.json bypasses the guard while the filesystem resolves it to the same protected file. All SiYuan versions before v3.8.2 are affected. No public exploit code or CISA KEV listing is identified at time of analysis.
Authorization bypass in SiYuan through 3.8.1 exposes private notebook content to low-privileged readers via the /api/file/getFile endpoint. Users assigned the reader role can circumvent the Visible:false notebook access control by directly requesting files with a known notebook identifier and file path, retrieving notebook metadata and internal configuration that the workspace owner intended to keep private. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but reader-role access is the only prerequisite for exploitation.
TLS private key disclosure in SiYuan <=3.8.1 allows any authenticated user - or any network client on default no-auth-code deployments - to exfiltrate the server's TLS private key (conf/key.pem) and CA private key (conf/ca.key) via a simple POST to /api/file/getFile. The root cause is a dual flaw: the IsForbiddenAbsPath() blocklist covers only conf/conf.json by exact match while leaving sibling key material unprotected, and the getFile handler unconditionally skips the blocklist for RoleAdministrator - a role granted to every authenticated user in v3.8.1. On TLS-enabled, network-exposed instances this enables retrospective decryption of captured HTTPS sessions and forgery of certificates already trusted by clients that imported SiYuan's CA. No public exploit identified at time of analysis; vendor-confirmed fix is available in v3.8.2.
SiYuan's full-text search logging mechanism writes admin API tokens in plaintext to an accessible log file when requests exceed internal timing thresholds, enabling authenticated low-privilege users to escalate to permanent administrative access. All self-hosted SiYuan instances before v3.8.2 are affected; because API tokens are passed as query parameters and the log file is retrievable via the built-in getFile endpoint, the privilege escalation path requires no additional exploitation steps beyond triggering a slow search and reading the file. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Vendor-released patch v3.8.2 resolves the issue.
Stored XSS in SiYuan before v3.8.2 enables authenticated users with upload access to bypass the asset extension blocklist by using file types such as .xht, .ehtml, .xsl, .xbl, or .rdf that browsers render as executable documents. When a victim opens or previews the malicious asset, embedded JavaScript runs in the SiYuan application context, allowing theft of API tokens and full workspace compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in v3.8.2.
Stored cross-site scripting in SiYuan before v3.8.1 lets an authenticated user plant HTML/script payloads in a block's name, alias, or memo field, which then execute in another user's session when that user views any document that references or displays the poisoned block via hint, backlink, or breadcrumb rendering. Because the malicious markup runs in the victim's authenticated context, an attacker can hijack sessions and act as the victim. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Stored cross-site scripting in SiYuan before v3.8.1 lets a low-privileged attacker persist HTML/script payloads in bazaar package names and notebook names, which the confirmDialog() function interpolates unescaped into innerHTML. The script executes in a victim's browser session when they uninstall a malicious package or unlock an encrypted notebook, enabling session-context takeover of the note-taking application. No public exploit identified at time of analysis and no active exploitation is recorded.
Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.
SiYuan before v3.8.1 exposes a DNS rebinding SSRF vulnerability in its http_request and web_fetch agent tools, allowing network-accessible attackers who can influence processed URLs to bypass the built-in SSRF IP-blocklist defense and reach cloud instance metadata services or internal network hosts. The guard-time-only DNS resolution creates a TOCTOU race: the SSRF check sees a legitimate public IP, but the actual TCP connection lands on 169.254.169.254 or another private address. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS 4.0 score of 8.4 reflects high downstream confidentiality risk for cloud-hosted deployments where metadata credentials are accessible.
Arbitrary file deletion in SiYuan before v3.7.4 allows authenticated administrators to recursively destroy any file or directory accessible to the SiYuan kernel process by supplying an unsanitized absolute path to the /api/search/removeTemplate endpoint, which passes the value directly to Go's os.RemoveAll. All SiYuan releases prior to v3.7.4 are confirmed affected per vendor advisory GHSA-w938-w7m4-qrj8. No public exploit or CISA KEV listing exists at time of analysis, but the high integrity and availability impact - including potential downstream filesystem destruction beyond the application - makes admin credential hygiene the critical control.
Stored cross-site-scripting-to-RCE in SiYuan (the open-source personal knowledge-management/note app) before v3.7.4 lets an attacker-crafted document execute arbitrary OS commands on a victim's machine. Document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated unescaped into the aria-label attribute of the file-tree 'move/link to' path-picker tooltip; a double quote breaks out of the attribute and injects an inline event handler. Because every SiYuan Electron window runs with nodeIntegration:true, contextIsolation:false and no CSP, the handler reaches require('child_process') and achieves command execution the moment the victim hovers the malicious entry. There is no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting escalating to arbitrary OS command execution affects the SiYuan personal knowledge-management application through version 3.7.3. Because the '((' block-reference autocomplete popup renders a candidate block's name, alias, and memo fields into HTML without escaping, an attacker who controls those metadata fields can plant a self-firing payload that runs the moment a victim types '((' and surfaces the crafted block; SiYuan's Electron shell runs with nodeIntegration enabled, contextIsolation disabled, and no CSP, so the injected script reaches require('child_process') and executes host commands. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the XSS-to-RCE chain is fully described by the VulnCheck advisory and vendor GHSA.
Publish-mode endpoint misconfiguration in SiYuan before v3.7.4 exposes operator-forbidden documents to anonymous remote visitors. Eight reader-facing API endpoints - covering search, backlinks, asset content, saved criteria, recent documents, graph, and tags - incorrectly apply the visibility access-control list rather than the disabled list, bypassing the intended publication restriction. Unauthenticated attackers can enumerate and read content that the SiYuan operator has explicitly marked as forbidden from publishing; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes private knowledge-base content to anonymous publish-mode readers through 17 insufficiently protected block API endpoints in kernel/api/block.go. Remote attackers without credentials can enumerate arbitrary block IDs to retrieve private text content, structural metadata, and block existence information across the entire workspace. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in v3.7.4 per GitHub Security Advisory GHSA-4vpg-gwqq-w44c.
Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.
Unthrottled brute-force against SiYuan's Publish Service Basic Auth allows remote unauthenticated attackers to enumerate passwords against named publish-viewer accounts and gain read access to published notes and notebooks. All SiYuan releases before 3.7.4 are affected wherever the Publish Service is enabled and network-accessible on its default TCP port 6808. No public exploit code has been identified at time of analysis, but the attack is trivially automatable using any standard HTTP client given the complete absence of rate limiting, per-account lockout, or exponential backoff in the vulnerable code path.
Cross-site WebSocket hijacking in SiYuan before 3.7.4 lets a remote unauthenticated attacker weaponize the victim's running SiYuan instance as a network proxy to arbitrary attacker-chosen targets. The /ws/network/proxy endpoint explicitly disables WebSocket origin validation by setting CheckOrigin to unconditionally return true, allowing malicious webpages to open unauthorized WebSocket connections through the victim's browser and issue proxy commands to the SiYuan kernel. No public exploit is confirmed in CISA KEV, but SSVC flags a POC exists; the CVSS 4.0 score is 7.1 and EPSS is 0.10%, indicating limited observed exploitation at time of analysis.
Local privilege escalation in SiYuan before 3.7.4 allows a low-privileged local attacker to execute arbitrary commands with administrator privileges by crafting a workspace directory whose path contains OS command metacharacters. When the victim triggers the Microsoft Defender exclusion workflow within SiYuan and approves the resulting UAC prompt, the application passes the unsanitized path to the elevated elevator.exe helper process, enabling command injection at administrator level. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.6 reflects the full-system compromise potential once the attack preconditions are met.
Stored cross-site scripting in SiYuan before v3.7.4 lets an authenticated user upload an HTML file through the asset-serving endpoint, which the server returns without Content-Disposition or X-Content-Type-Options headers, so the browser renders it inline instead of downloading it. When the workspace owner clicks the malicious asset link, the injected script runs in the app's origin with full kernel API access, enabling account and data compromise. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before 3.7.4 exposes Go net/http/pprof debug endpoints (heap, goroutine, and related dumps) to any remote client whenever the application is not started with --mode set exactly to prod. Because non-prod is the effective default, attackers can query /debug/pprof/heap to scrape live process memory and recover secrets such as the AccessAuthCode and configured AI provider API keys. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Arbitrary file read and deletion in SiYuan kernel before v3.7.4 arises from an unvalidated id parameter in the database_clean MCP tool, letting an authenticated MCP client traverse the filesystem to copy any process-readable file into the history directory and then delete the original. This is the MCP-facing twin of a flaw previously fixed on the HTTP API path (GHSA-7hm9-v7vf-7g4w), meaning a known-bad code pattern survived in a second caller. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and not listed in CISA KEV.
Unthrottled API-token brute force in SiYuan kernel before 3.7.4 lets an unauthenticated remote attacker repeatedly guess the Conf.Api.Token because the CheckAuth() middleware bypasses the app's CAPTCHA/lockout controls (NeedCaptcha/WrongAuthCount). Reported by VulnCheck and fixed in 3.7.4, a successful guess yields full RoleAdministrator access, permitting arbitrary file operations and SQL queries. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the CVSS 4.0 base score is 9.3.
SQL injection in SiYuan's backlink/mention search (kernel/model/backlink.go) lets unauthenticated attackers execute arbitrary SQL against the self-hosted note-taking application through v3.7.2. Because the search routine escapes only double quotes and leaves single quotes intact, a crafted keyword or malicious stored block metadata breaks out of the SQL string literal on the primary read-write siyuan.db handle, enabling cross-notebook read and write. VulnCheck reports the flaw (CVSS 4.0 base 9.9); no public exploit identified at time of analysis, and it is fixed in v3.7.4.
Unauthorized disclosure of private content in SiYuan (siyuan-note) versions before v3.7.4 lets anonymous, unauthenticated clients subscribe to the WebSocket broadcast channel on the publish surface and receive real-time editing events for every document, including password-protected and explicitly forbidden ones. Reported by VulnCheck and documented in the vendor's GHSA advisory, the flaw is a missing authorization (CWE-862) check on broadcast sessions rather than a memory-corruption bug. No public exploit identified at time of analysis, but the trivial network-only access path and 9.2 CVSS 4.0 score make this a high-priority confidentiality issue for any exposed publish deployment.
Missing authorization in SiYuan's /api/av/getAttributeViewSearchTarget endpoint allows an anonymous reader to retrieve database (attribute view) row content that publish-access filtering should hide. The affected route was added by commit 9b8e8956f and exists only in the development branch - it is absent from v3.7.3 and master and was fixed in v3.7.4, so no released stable version is affected. There is no public exploit identified at time of analysis and it is not in CISA KEV; despite the 9.2 CVSS the real-world exposure is limited to self-built development instances.
Authentication bypass in SiYuan's kernel CheckAuth function unconditionally grants administrator privileges (RoleAdministrator) to any HTTP request whose RemoteAddr is 127.0.0.1, affecting a specific set of endpoints including /api/system/exit, /assets/*, and /export/*, even when an access auth code is explicitly configured. All versions up to and including v3.7.2 are affected; v3.7.4 contains the vendor-released patch. The fixed-port reverse proxy forwards requests to the kernel over loopback without injecting authentication tokens or configuring trusted proxy headers, creating a theoretical remote unauthenticated attack path if the proxy is bound to a network-accessible interface - though per the advisory this remote scenario was established only by code inspection and was not reproduced end-to-end. No public exploit code exists and this CVE is not listed in the CISA KEV catalog.
Second-order SQL injection in SiYuan's attribute-view template columns allows a remote attacker to execute arbitrary SQL against a victim's local kernel database by distributing a crafted document or package. All SiYuan releases before v3.7.4 are affected; the `queryBlocks` function processes attacker-controlled template column data through raw string substitution rather than parameterized queries, granting full read and write access across all notebooks upon import and render. No public exploit has been identified at time of analysis, but the attack is practically feasible in any community or collaborative context where SiYuan packages are exchanged.
Information disclosure in SiYuan, a self-hosted block-based personal knowledge management app, lets anonymous, unauthenticated network callers read the contents of password-protected documents. Versions before v3.7.4 skip the publish-password tier check in the getGraph and getLocalGraph endpoints, so an attacker who reaches the instance can retrieve block-level text and the full reference/link topology of protected notes without ever supplying the publish password. Reported by VulnCheck and fixed in v3.7.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SiYuan's publish mode in versions before v3.7.4 leaks Argon2id key-derivation material - including salt, cost parameters, password verifiers, and wrapped notebook data keys - through unauthenticated HTTP endpoints, enabling unlimited offline master-password cracking. Remote unauthenticated attackers who can reach a publish-mode SiYuan instance can retrieve all inputs needed to run offline Argon2id cracking campaigns with no server-side rate limiting. No public exploit has been identified at time of analysis, but the attack requires only standard HTTP requests once the target is located.
Sensitive data disclosure in SiYuan note-taking application before v3.7.4 lets anonymous readers of a published workspace pull Relation and Rollup cell contents out of hidden or password-protected databases. Because renderAttributeView does not re-check authorization on the related database, an unauthenticated visitor can request a published attribute view that references a restricted database and read its protected values, and can bypass row-level filtering entirely when the first column is a non-block type. Reported by VulnCheck with a CVSS 4.0 base score of 9.2; no public exploit identified at time of analysis.
Unauthorized cross-document content disclosure in SiYuan note-taking software before v3.7.4 allows remote attackers to read protected notes without credentials. The getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints resolve embed queries inside published blocks without re-checking publish-access controls, so an attacker who reaches a published SiYuan workspace can pull back content from password-protected, hidden, or forbidden documents. No public exploit identified at time of analysis, but VulnCheck rates it CVSS 9.2 (CVSS 4.0) and it constitutes an authentication/authorization bypass.
Credential disclosure in SiYuan note-taking software before v3.7.4 lets unauthenticated remote attackers read the session cookie signing key (CookieKey) from the /api/system/getConf endpoint when an instance runs in publish mode. With that key an attacker can mint valid signed session cookies, impersonate any user, and escalate to administrative control of the workspace. Reported by VulnCheck with a vendor security advisory (GHSA-34fj-mwm6-fjfg); no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Sensitive credential exposure in SiYuan (self-hosted note-taking app) before v3.7.4 allows anonymous or publish-reader users to query the /api/system/getConf endpoint and retrieve unmasked secrets, including the session-cookie signing key, the OS username (leaked via the pandoc path), and encrypted-notebook key material. With the signing key, attackers forge and tamper with session cookies to impersonate any user, and on instances that have not configured an access-auth code they can escalate to full administrator privileges. No public exploit identified at time of analysis, but the flaw is remotely reachable without authentication against default configurations.
Anonymous information disclosure in SiYuan before v3.7.4 lets unauthenticated remote readers retrieve fully decrypted content from encrypted notebooks. Because the publish API treats encrypted notebooks as publicly accessible by default, any anonymous visitor can enumerate and read documents from an unlocked encrypted notebook without authentication or knowledge of the encryption key. Reported by VulnCheck and rated CVSS 4.0 9.2; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Path traversal in SiYuan's attribute-view read endpoints allows low-privileged users to read arbitrary JSON files outside the intended storage directory on versions before v3.7.3. The avID parameter is unsanitized across all code branches, enabling RoleReader-level authenticated users - or anonymous clients when publish authentication is disabled - to exfiltrate cross-scope database content stored as JSON on the server filesystem. No public exploit has been identified at time of analysis, and a vendor patch is available in v3.7.3.
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitrary SQL through the unescaped keyword parameter of the /api/filetree/searchDocs endpoint. Because the query runs on a read-write SQLite handle that permits stacked statements, an attacker can both read and tamper with content across every cleartext notebook, and the endpoint is reachable unauthenticated when publish mode runs with Publish.Auth.Enable=false. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and the CVSS 4.0 score is 9.9.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements verbatim to the primary read-write siyuan.db handle via the /api/search/searchEmbedBlock endpoint. Because the endpoint is gated only by CheckAuth, it is reachable with the low-privilege publish RoleReader token - and by fully anonymous users when publish authentication is disabled - and the driver's support for stacked statements allows both reading and modifying content across all opened cleartext notebooks. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a critical 9.9 CVSS 4.0 score; it is fixed in v3.7.3.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish RoleReader tokens execute arbitrary SQL against the read-write asset-content database in all versions before v3.7.3. Because the endpoint is reachable without authentication and the database is writable, attackers can read, alter, or delete data across notebooks - not merely exfiltrate it. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.9.
Information disclosure in SiYuan (a personal knowledge-management/note-taking application) before v3.7.3 lets anonymous readers or low-privilege publish RoleReader tokens read the full rendered content of documents that were explicitly marked publish-disabled. The getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints return rendered block DOM without enforcing publish-access checks, so supplying a target heading block ID leaks restricted content. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Broken access control in SiYuan versions before 3.7.3 lets publish-mode readers - including anonymous users when publish Basic Auth is disabled - retrieve the rendered content of publish-forbidden documents by calling the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc endpoints directly with a target document ID. Although the corresponding backlink list endpoints correctly filter publish-forbidden documents, these two content endpoints are gated only by CheckAuth and omit the publish-access filter, exposing DOM content and a reference-existence oracle. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Authentication bypass in SiYuan (self-hosted knowledge-management/note-taking app) versions before v3.7.3 allows anonymous readers in publish mode to exfiltrate the full content of password-protected documents. While the primary getDoc endpoint enforces the publish-mode password, sibling content-returning endpoints (getHeadingChildrenDOM, the getHeading*Transaction family, and getBacklinkDoc) omit that check, so an attacker who harvests internal block IDs from reader-accessible endpoints can pull protected content directly. VulnCheck reported the issue and a vendor patch (v3.7.3) is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote administrator takeover in SiYuan before v3.7.2 via missing authorization on the /mcp kernel endpoint. When the Publish server is in anonymous mode, a remote attacker can invoke 31 MCP tools—including full file-system read, write, and delete—to exfiltrate secrets from conf/conf.json and plant a malicious plugin that runs with elevated desktop privileges. While no active exploitation has been confirmed by CISA KEV, detailed exploit information is publicly available, and the vulnerability carries a maximum CVSS severity.
Cross-site scripting escalating to remote code execution in SiYuan (open-source personal knowledge management) before 3.7.1 lets an attacker embed a crafted asset link whose path contains a double quote, breaking out of an image src attribute in Asset.render to inject an event handler. Because SiYuan runs in an Electron renderer with OS-level capabilities, the injected JavaScript can execute arbitrary operating-system commands on the victim's machine once the malicious asset is opened. No public exploit identified at time of analysis, and it is not listed in CISA KEV; user interaction is required to trigger the flaw.
Authenticated path traversal in SiYuan personal knowledge management system (versions prior to 3.7.1) lets a low-privileged user read arbitrary workspace files by abusing the /snippets/*filepath handler. Because serveSnippets in kernel/server/serve.go single-decodes the request path and joins it to the snippets directory without containment or sensitive-file checks, a request like /snippets/%2e%2e/%2e%2e/conf/conf.json returns workspace secrets and the document database. No public exploit identified at time of analysis, though the fixing commit publicly reveals the vulnerable code path.
Stored cross-site scripting in SiYuan before 3.7.1 escalates to OS command execution inside the Electron desktop renderer because the bundled Lute Markdown/HTML engine sanitizes content but fails to block dangerous javascript schemes in form action and SVG xlink:href attributes. An attacker who plants crafted content that a victim later opens via document export-preview or a Bazaar package README render can run arbitrary code on the victim's machine. There is no public exploit identified at time of analysis, and it is not on CISA KEV; the CVSS 4.0 base score is 8.6.
SQL injection in SiYuan's block-search endpoint (POST /api/search/fullTextSearchBlock) before version 3.7.1 lets an unauthenticated publish-mode visitor read documents they should not see. The endpoint concatenates attacker-controlled `paths` values directly into SQL predicates used by its non-SQL search modes, enabling a UNION SELECT that projects rows from hidden documents by spoofing an allowed visible box and path. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; CVSS is 7.5 reflecting confidentiality-only impact.
Stored cross-site scripting leading to OS command execution in SiYuan, an open-source personal knowledge management system, affects all desktop client versions prior to 3.7.0. Untrusted marketplace package metadata (name, version, author, description) is serialized via JSON.stringify() into a single-quoted data-obj HTML attribute without escaping single quotes or angle brackets, so a package name containing a single quote breaks out of the attribute and injects arbitrary HTML; because the Electron BrowserWindow runs with nodeIntegration:true and contextIsolation:false, the DOM XSS escalates to arbitrary command execution on the host. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-x88j-wgpr-h22x) notes this is the same root cause and impact as a prior advisory, reached through a sibling sink the earlier patch missed.
Arbitrary command execution in the SiYuan Electron desktop client (versions prior to 3.7.0) allows a remote attacker to run OS commands on a victim's machine when they merely view a malicious Bazaar marketplace package's README. The root cause is that Lute's HTML sanitizer fails to strip <iframe> elements, which combine with the Electron client's permissive security settings (e.g. node integration / relaxed sandboxing) to escalate stored XSS into full code execution; notably no package installation is required, only viewing the package details. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (High) reflects high confidentiality, integrity, and availability impact.
Stored cross-site scripting in SiYuan's Attribute View (database) asset cell renderer escalates to remote code execution on the Electron desktop client for all versions prior to 3.7.0. An attacker who can persist crafted content into a database asset cell has malicious JavaScript executed in the privileged Electron context, breaking out to the host operating system; the issue carries a 9.9 CVSS and is fixed in 3.7.0. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Stored cross-site scripting in SiYuan's attribute-view (database) cell renderer, affecting all versions prior to 3.7.0, lets a low-privileged attacker with write access to a synced workspace plant a persistent payload that runs arbitrary JavaScript when a victim opens the block-attribute panel. The genAVValueHTML function interpolates cell content raw in its text, url, phone, and mAsset branches and the Go kernel never escapes the value on input, so the malicious row survives sync byte-for-byte and fires on every device that renders it; on the Electron desktop client (nodeIntegration:true) the XSS escalates to host remote code execution via require('child_process'). CVSS is rated 9.9; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in SiYuan personal knowledge management system before 3.7.0 allows a third-party Bazaar package author to execute JavaScript in an Administrator's authenticated workspace origin. The lute sanitizer used by renderPackageREADME relies on a stale event-handler blocklist that omits modern DOM event attributes (onpointerover, onpointerdown, onauxclick, onbeforetoggle, onfocusin, onanimationstart, ontransitionend), and the rendered README HTML is injected via innerHTML with no client-side DOMPurify and no CSP/X-Frame-Options/X-Content-Type-Options headers. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but successful exploitation yields full control of the victim's workspace.
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chrome/Chromium browser extension obtain RoleAdministrator access to the local kernel HTTP server at 127.0.0.1:6806. Because the kernel unconditionally trusts all chrome-extension:// origins and desktop installs ship with an empty AccessAuthCode by default, a malicious or supply-chain-compromised extension can issue fully authenticated admin API calls with no further authentication, enabling data exfiltration, stored XSS injection, and configuration tampering. Publicly available exploit code exists; there is no public exploit identified as actively exploited.
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a synced workspace plant a CSS snippet whose '</style>' sequence breaks out of the surrounding <style> tag when renderSnippet() interpolates it via insertAdjacentHTML, running arbitrary JavaScript in the renderer. On Electron desktop builds the renderer runs with nodeIntegration:true, so the injected handler can reach require('child_process') and escalate the XSS to full host remote code execution. The payload syncs through the workspace repository and fires automatically on every device that pulls, and it bypasses the user's enabledJS=off setting; no public exploit or CISA KEV listing is identified at time of analysis.
Arbitrary file disclosure in SiYuan personal knowledge management system before 3.7.0 lets an unauthenticated remote attacker read any file inside the workspace directory through its publish-mode HTTP endpoint (default port 6808). The flaw is an incomplete fix for CVE-2026-41894: the earlier patch sanitized the /export/ route but left the identical double-URL-encoding path traversal in the /assets/*path route, exposing conf/conf.json (AccessAuthCode SHA256 hash, API token, sync keys), the temp SQLite databases, and siyuan.log. Publicly available exploit code exists; no public active exploitation has been confirmed.
Remote code execution in SiYuan note-taking application (before v3.6.1) allows any malicious Bazaar marketplace package author to compromise users via unsanitized HTML rendering of package displayName, description, and README content. Because the Electron renderer is configured with nodeIntegration:true and contextIsolation:false, injected JavaScript pivots directly to arbitrary OS command execution. No public exploit identified at time of analysis, but VulnCheck published a detailed technical advisory documenting both zero-click (metadata) and one-click (README) vectors.
Stored cross-site scripting in SiYuan's Bazaar marketplace (versions 2.1.12 through 3.6.x) enables arbitrary code execution on the host system. The vulnerability stems from unescaped package author metadata rendering, which when exploited through a malicious marketplace package, allows attackers to leverage SiYuan's insecure Electron configuration (nodeIntegration enabled, contextIsolation disabled) to execute Node.js APIs and OS-level commands. No public exploit or active exploitation confirmed at time of analysis. CVSS 8.3 with high attack complexity and required user interaction suggests real-world exploitation depends on convincing users to view crafted marketplace entries.
Directory traversal in SiYuan personal knowledge management system allows authenticated attackers to read arbitrary workspace files via double URL encoding bypass. The vulnerability stems from an incomplete fix for CVE-2026-30869 that added only denylist validation without removing a redundant url.PathUnescape() call in serveExport(). Attackers can use %252e%252e encoding to access sensitive files including the complete SQLite database (siyuan.db), kernel logs, and all user documents. EPSS data not available for this recent CVE; publicly available exploit code exists (GitHub commit demonstrates exploitation technique).
Authenticated local users can execute arbitrary code on Windows, macOS, and Linux via HTML injection in SiYuan desktop notification messages through version 3.6.4. The Electron-based desktop application mishandles notification rendering with unsafe settings (nodeIntegration enabled, contextIsolation disabled, webSecurity disabled), escalating XSS to full system compromise. Vendor-released patch available in version 3.6.5. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Stored cross-site scripting escalating to remote code execution in SiYuan (b3log) versions 3.6.3 and below, where Mermaid diagrams render with securityLevel 'loose' and inject SVG via innerHTML, letting javascript: URLs in Mermaid code blocks survive into the DOM. On Electron desktop builds — created with nodeIntegration enabled and contextIsolation disabled — a victim opening a note with a malicious Mermaid block and clicking the diagram node triggers arbitrary code execution. Publicly available exploit code exists (SSVC 'poc'); not listed in CISA KEV, and EPSS is very low at 0.05%.
Arbitrary server-side file deletion in SiYuan (b3log/SiYuan) versions 3.6.3 and prior lets a low-privileged actor with access to the /api/av/removeUnusedAttributeView endpoint - such as a Reader-role or publish context - supply an id parameter containing ../ sequences to escape the storage/av directory and delete any .json file on the server, including conf/conf.json and workspace metadata. The GitHub Security Advisory (GHSA-vw86-c94w-v3x4) includes step-by-step reproduction, so publicly available exploit code exists, but there is no public exploit identified as weaponized and SSVC exploitation status is 'none'; EPSS is low at 0.06%. Fixed in version 3.6.4.
NTLM credential theft in SiYuan personal knowledge management system (prior to 3.6.4) allows remote attackers to capture Windows user password hashes without authentication or user interaction. Misconfigured Mermaid.js rendering with securityLevel:loose permits unsanitized <img> tags within SVG foreignObject blocks. Protocol-relative URLs in malicious Mermaid diagrams trigger automatic SMB authentication on Windows, transmitting NTLMv2 hashes to attacker-controlled servers when victims open compromised notes. Electron client processes the SVG via innerHTML without secondary sanitization, enabling SSRF to UNC paths.
Remote code execution in SiYuan desktop client (Electron-based) versions prior to 3.6.4 allows authenticated attackers to execute arbitrary code on victim systems via malicious notes propagated through workspace sync. Stored XSS in table caption fields escalates to RCE due to nodeIntegration enabled and contextIsolation disabled in Electron renderer. CVSS 9.0 (Critical) with scope change indicates escape from browser context. No active exploitation confirmed (not in CISA KEV). EPSS score 0.14% suggests low current exploitation probability. Vendor-released patch: version 3.6.4.
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers to execute arbitrary JavaScript via the unauthenticated /api/icon/getDynamicIcon endpoint by bypassing SVG sanitization using XML namespace-prefixed element names. The vulnerability exploits a parser inconsistency where Go's HTML5 parser treats 'x:script' as a distinct tag while browsers' XML parsers resolve the namespace prefix to execute the script. Publicly available exploit code exists (GitHub issue #17246 documents the bypass technique), though no CISA KEV listing indicates mass exploitation campaigns at time of analysis.
Stored cross-site scripting (XSS) in SiYuan personal knowledge management system versions prior to 3.6.2 escalates to remote code execution in the Electron desktop client. Attackers craft malicious .sy.zip import files containing HTML entities mixed with raw special characters that bypass server-side attribute escaping, injecting event handlers into imported notes. When victims open the compromised note in the Electron client, injected JavaScript executes with full Node/Electron API access, enabling arbitrary code execution. CVSS 8.6 (High) with local attack vector requiring user interaction; no public exploit identified at time of analysis.
Unauthenticated information disclosure in SiYuan personal knowledge management system versions before 3.6.2 allows remote attackers to retrieve confidential content from password-protected documents via the publish service's bookmark API endpoint. The vulnerability bypasses document-level access controls by treating nil authentication contexts as authorized during bookmark filtering, exposing any bookmarked blocks without password verification. CVSS 7.5 (High) with network-based exploitation requiring no privileges or user interaction; no public exploit identified at time of analysis, though the security advisory provides detailed technical disclosure.
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to execute arbitrary code with full operating system privileges through CORS misconfiguration. A malicious website can inject JavaScript into the Electron-based application's Node.js context via the permissive API (Access-Control-Allow-Origin: * with Access-Control-Allow-Private-Network: true), which executes with OS-level access when the user next opens SiYuan's interface. No public exploit identified at time of analysis, though CVSS 9.6 (Critical) reflects network-accessible attack vector with low complexity requiring only user interaction (visiting malicious site while SiYuan runs). EPSS data not provided, but the combination of Electron framework exploitation, RCE impact, and trivial attack complexity suggests elevated real-world risk for desktop users.
Stored cross-site scripting (XSS) in SiYuan personal knowledge management system escalates to arbitrary operating system command execution on desktop clients. Authenticated attackers with low privileges can inject malicious URLs into Attribute View asset fields that execute JavaScript when victims view Gallery or Kanban layouts with "Cover From -> Asset Field" enabled. The Electron desktop client's configuration (nodeIntegration enabled, contextIsolation disabled) allows the XSS payload to break sandbox boundaries and execute arbitrary commands under the victim's OS account. CVSS 9.0 (Critical) with network attack vector, low complexity, and cross-scope impact. Vendor-released patch: version 3.6.2. No public exploit identified at time of analysis, though technical details are disclosed in GitHub advisory GHSA-rx4h-526q-4458.
SiYuan personal knowledge management system contains a cross-site scripting (XSS) vulnerability in versions 3.6.0 and below. An unauthenticated attacker can exploit the /api/icon/getDynamicIcon endpoint by crafting a malicious URL that bypasses SVG sanitization filters, allowing arbitrary JavaScript execution when a victim clicks an injected link within the rendered SVG. The CVSS score of 9.3 indicates critical severity, though exploitation requires user interaction (clicking a malicious link) and the attack complexity is low.
SiYuan personal knowledge management system versions 3.6.0 and below contain a path traversal vulnerability that allows authenticated attackers to exfiltrate arbitrary readable files from the system. An attacker with low-level privileges can exploit the /api/lute/html2BlockDOM endpoint to copy sensitive files to the workspace assets directory via malicious file:// links in pasted HTML, then retrieve them through the authenticated GET /assets/ endpoint. This is a critical vulnerability with a CVSS score of 9.9 due to its potential for high confidentiality impact and scope change, though no active exploitation (KEV) or public proof-of-concept has been documented.
SiYuan knowledge management system versions 3.6.0 and below allow unauthenticated WebSocket connections to the /ws endpoint via specific URL parameters, enabling attackers to bypass authentication and receive real-time server push events. An attacker can exploit this by connecting from a malicious website to monitor a victim's local SiYuan instance and exfiltrate sensitive metadata including document titles, notebook names, file paths, and user activity without the victim's knowledge. No patch is currently available for this high-severity information disclosure vulnerability.