Siyuan Note
Monthly
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chrome/Chromium browser extension obtain RoleAdministrator access to the local kernel HTTP server at 127.0.0.1:6806. Because the kernel unconditionally trusts all chrome-extension:// origins and desktop installs ship with an empty AccessAuthCode by default, a malicious or supply-chain-compromised extension can issue fully authenticated admin API calls with no further authentication, enabling data exfiltration, stored XSS injection, and configuration tampering. Publicly available exploit code exists; there is no public exploit identified as actively exploited.
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a synced workspace plant a CSS snippet whose '</style>' sequence breaks out of the surrounding <style> tag when renderSnippet() interpolates it via insertAdjacentHTML, running arbitrary JavaScript in the renderer. On Electron desktop builds the renderer runs with nodeIntegration:true, so the injected handler can reach require('child_process') and escalate the XSS to full host remote code execution. The payload syncs through the workspace repository and fires automatically on every device that pulls, and it bypasses the user's enabledJS=off setting; no public exploit or CISA KEV listing is identified at time of analysis.
Arbitrary file disclosure in SiYuan personal knowledge management system before 3.7.0 lets an unauthenticated remote attacker read any file inside the workspace directory through its publish-mode HTTP endpoint (default port 6808). The flaw is an incomplete fix for CVE-2026-41894: the earlier patch sanitized the /export/ route but left the identical double-URL-encoding path traversal in the /assets/*path route, exposing conf/conf.json (AccessAuthCode SHA256 hash, API token, sync keys), the temp SQLite databases, and siyuan.log. Publicly available exploit code exists; no public active exploitation has been confirmed.
Stored cross-site scripting in SiYuan's Bazaar marketplace (versions 2.1.12 through 3.6.x) enables arbitrary code execution on the host system. The vulnerability stems from unescaped package author metadata rendering, which when exploited through a malicious marketplace package, allows attackers to leverage SiYuan's insecure Electron configuration (nodeIntegration enabled, contextIsolation disabled) to execute Node.js APIs and OS-level commands. No public exploit or active exploitation confirmed at time of analysis. CVSS 8.3 with high attack complexity and required user interaction suggests real-world exploitation depends on convincing users to view crafted marketplace entries.
Directory traversal in SiYuan personal knowledge management system allows authenticated attackers to read arbitrary workspace files via double URL encoding bypass. The vulnerability stems from an incomplete fix for CVE-2026-30869 that added only denylist validation without removing a redundant url.PathUnescape() call in serveExport(). Attackers can use %252e%252e encoding to access sensitive files including the complete SQLite database (siyuan.db), kernel logs, and all user documents. EPSS data not available for this recent CVE; publicly available exploit code exists (GitHub commit demonstrates exploitation technique).
Authenticated local users can execute arbitrary code on Windows, macOS, and Linux via HTML injection in SiYuan desktop notification messages through version 3.6.4. The Electron-based desktop application mishandles notification rendering with unsafe settings (nodeIntegration enabled, contextIsolation disabled, webSecurity disabled), escalating XSS to full system compromise. Vendor-released patch available in version 3.6.5. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Remote code execution in SiYuan desktop client (Electron-based) versions prior to 3.6.4 allows authenticated attackers to execute arbitrary code on victim systems via malicious notes propagated through workspace sync. Stored XSS in table caption fields escalates to RCE due to nodeIntegration enabled and contextIsolation disabled in Electron renderer. CVSS 9.0 (Critical) with scope change indicates escape from browser context. No active exploitation confirmed (not in CISA KEV). EPSS score 0.14% suggests low current exploitation probability. Vendor-released patch: version 3.6.4.
SiYuan knowledge management system versions 3.6.0 and below allow unauthenticated WebSocket connections to the /ws endpoint via specific URL parameters, enabling attackers to bypass authentication and receive real-time server push events. An attacker can exploit this by connecting from a malicious website to monitor a victim's local SiYuan instance and exfiltrate sensitive metadata including document titles, notebook names, file paths, and user activity without the victim's knowledge. No patch is currently available for this high-severity information disclosure vulnerability.
SQL injection in the SiYuan note-taking kernel's history search handlers (all builds up to and including v3.8.6) lets anyone holding a valid admin API token read the contents of history.db beyond what the history API is meant to expose, including content, titles and paths of previously deleted documents. The flaw is privileged rather than remote-unauthenticated: the actor must already possess the workspace admin token, obtain it from ws/conf/conf.json, complete the login flow, or operate inside a client that holds it, such as a malicious plugin or the MCP history tool. Impact is read-only confidentiality loss against history.db - no integrity or availability effect - and the vendor advisory ships a reproduction that was validated against a source-built v3.8.6 kernel; no confirmed active exploitation (CISA KEV) was reported and the priority label is this_month.
Stored cross-site scripting in SiYuan Note 2.10.0 through 3.8.6 lets a user who already holds edit permission on a document plant a `javascript:` URL inside math-block content, for example `$$\href{javascript:alert('xss')}{clickme}$$`, so that script runs in the application origin when a reader clicks the rendered link. The rendering path passes math TeX to KaTeX with `trust: true` and mounts the resulting HTML through `innerHTML`, so `\href`, `\url` and `\includegraphics` payloads (including mixed-case `JaVaScRiPt:` schemes) survive unsanitized. Exploitation is not unauthenticated and is not automatic: the attacker needs writer access to a shared document and the victim must open it and click, which caps practical severity at CVSS 5.1; the vendor advisory GHSA-hhvq-jqv9-pgjq includes a detailed proof-of-concept reproduction against a real Chromium instance, though no CISA KEV listing or public weaponized exploit is reported, and the priority label is this_month.
SiYuan's MCP asset tool fails to block dotenv-style secret files, so an attacker who can drive an authenticated MCP client can copy a file such as ~/.env from the server host into the workspace and then read it back over HTTP from /assets/. The flaw is an incomplete fix of GHSA-p23f-cm6q-2qp8: the sensitive-path check is a 17-entry home-dotfile blacklist (.ssh, .aws, .kube, .docker, .gnupg, .git-credentials, credentials*, id_*) that omits .env, .env.local, .env.production, ~/Library, other users' home directories and Windows AppData. Public proof-of-concept reproduction steps exist and were executed against a self-hosted SiYuan 3.8.6 lab; because the MCP server must be exposed and the attacker needs a valid SiYuan API token, the issue is a moderate, not emergency, priority (this_month).
Absolute path traversal in the SiYuan kernel's private plugin HTTP server (SiYuan 3.7.0 through 3.8.5) allows an attacker-supplied kernel plugin to read any file readable by the SiYuan process, including the API token and conf.json, by returning an absolute path in its handler's ResponseFile.Path that the kernel passes unvalidated to gin's Context.File. The plugin's private endpoint requires no authentication or privileges to reach (PR:N), but the CVSS 4.0 vector carries UI:A and our assessment confirms the decisive precondition is user action: a victim must install and load a malicious third-party kernel plugin, so a default installation is not exposed on its own. No public exploit identified at time of analysis and the issue is not in CISA KEV; vendor-released patch is SiYuan 3.8.6, which rejects any path resolving outside the workspace.
Information disclosure in SiYuan before 3.8.5 allows publish-mode readers to extract backlink block IDs (refIDs) and reference counts (refCount) belonging to password-protected or publish-disabled documents by POSTing a published document ID to /api/block/getDocInfo or /api/block/getDocsInfo. The attacker only needs network reachability to the publish endpoint and knowledge of a valid published document ID - no authentication is required per the CVSS vector (PR:N) - and the exposed data is metadata about hidden referencing blocks rather than the protected documents' content. Exploitation requires the instance to actually be running in publish mode with at least one published document that is referenced by a protected or unpublished note; there is no public exploit identified at time of analysis, and a vendor fix is available in SiYuan 3.8.5.
Metadata disclosure in the SiYuan note-taking and publishing platform before v3.8.5 allows unauthenticated remote attackers to learn details about documents that the publisher deliberately excluded from the public view. By querying the getNotebookInfo endpoint against a publish-visible notebook, an attacker - including an anonymous visitor whenever no reader password is configured - can retrieve the document count, storage size, and modification timestamps of hidden (publish-excluded) documents. This is a genuine but modest-severity exposure (assessed CVSS 3.1 base 5.3, C/L only, no integrity or availability impact) rather than a high-urgency priority; no public exploit has been identified at time of analysis, and a vendor patch is available in v3.8.5. The most consequential aspect is the information leak itself: counts, sizes, and timestamps can reveal the existence, volume, and edit cadence of private material.
SiYuan before v3.8.5 allows unauthenticated publish visitors to learn unpublished notebook box IDs through missing authorization in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time. This medium-severity information disclosure requires the Publish feature to be enabled and reachable; no public exploit code has been identified at time of analysis, and vendor patch v3.8.5 is available.
Information disclosure in SiYuan before v3.8.4 allows publish readers to retrieve image asset paths and filenames from attribute-view (database) rows that the publish configuration should have hidden. The getCurrentAttrViewImages endpoint skips the database-level publish-access check that its sibling rendering endpoint enforces, so an attacker who first obtains an unrendered database identifier from a related endpoint can supply it as avID and receive asset paths for detached rows. The flaw is remotely reachable without authentication (CVSS PR:N) and rated CVSS 6.9 (confidentiality-only, low impact); no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the vendor has released v3.8.4 to correct it.
Cross-workspace denial of service in the SiYuan desktop (Electron) app lets a renderer that is connected to an attacker-controlled remote kernel broadcast a lockscreen command through the 'siyuan-send-windows' IPC handler, locking unrelated local workspace windows. The vulnerable handler does not validate the IPC sender or restrict recipients, so it forwards the payload to every window returned by BrowserWindow.getAllWindows(); sibling windows configured with lockScreenMode=1 invoke lockScreen() on receipt, and repeat messages keep those windows locked. Per the CVSS 4.0 vector the IPC path requires no privileges (PR:N) but does require user interaction (UI:P) - the victim must have multiple workspaces open and must have connected one renderer to the hostile kernel - and impact is availability-only, recoverable by manually unlocking; no public exploit code has been identified at time of analysis.
SiYuan versions through 3.8.4 fail to enforce authorization on the getDynamicIcon endpoint, allowing authenticated attackers holding a read-only publish token to disclose metadata-such as block titles, names, aliases, and hierarchical paths-of restricted documents via a template injection triggered by type=8 requests. The flaw is rated medium severity (vendor CVSS 5.3, independent CVSS 3.1 5.3) and impacts confidentiality only; no public exploit or active exploitation has been identified at time of analysis.
Information disclosure in Siyuan note-taking software before v3.8.2 allows unauthenticated publish-mode readers to probe the existence and quantity of private or unpublished content via the full-text search API. The POST /api/search/fullTextSearchBlock endpoint correctly withholds actual block content from hidden documents but leaks unfiltered match counts - the number of matching blocks and pages - enabling attackers to use the search API as an oracle to systematically map the structure of private content without ever seeing it. No public exploit code has been identified at time of analysis, and the vendor has released a patch in v3.8.2.
SiYuan's `getAttributeViewKeysByID` endpoint, present in all versions before v3.8.2, allows authenticated publish readers to retrieve full key schemas-including sensitive field names and relation definitions-from private or hidden databases they have no visibility into. The flaw is an authorization bypass (CWE-639/IDOR) where the endpoint validates that a caller holds a publish-reader session but never verifies the caller's access rights against the parent database owning the requested attribute view. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk moderate despite the network-accessible attack vector.
Authenticated readers in SiYuan v3.8.1 can call the POST /api/transactions/undoState endpoint with a known document root ID to retrieve internal root IDs of other documents - including private or unpublished ones - that participated in the same cross-document transaction. The flaw is CWE-639 (IDOR via user-controlled key): the endpoint reads from the global undo-log stack and returns peekMutatedRootIDs without applying publish-access visibility filtering to the returned identifiers. Document body contents are not exposed; however, internal identifiers and cross-document transaction relationships leak across trust boundaries. Vendor-released patch v3.8.2 resolves the issue; no public exploit or CISA KEV listing is known at time of analysis.
SiYuan's publish mode before v3.8.1 leaks invisible-tier content to unauthenticated readers through three unguarded rendering pathways: SQL embed blocks, attribute-view keys, and attribute-view backlinks. Administrators who mark notes as invisible to control what anonymous visitors see receive no protection - those same visitors can enumerate the hidden content by exploiting any of the three listing mechanisms. No active exploitation has been identified (no CISA KEV listing, no public POC), and the vendor has released a fix in v3.8.1.
Authenticated administrators in SiYuan before v3.8.1 can bypass the IsForbiddenAbsPath security guard - introduced to remediate GHSA-c8r8-95hg-mp34 - by targeting the /history/*path and /repo/diff/*path API endpoints, which construct file paths independently and were never covered by the guard. Exploitation enables retrieval of historical file snapshots including data/.siyuan/publishAccess.json, which stores plaintext publish-mode passwords, and files under data/templates/. No public exploit identified at time of analysis; the vendor-released patch is v3.8.1.
Path traversal in SiYuan 3.8.0 allows an authenticated attacker to read arbitrary files within the workspace directory via the POST /api/template/render endpoint, including conf/conf.json, which contains the API token and cookie signing key. The RenderTemplate function enforces only a workspace-boundary check (util.IsAbsPathInWorkspace) but omits the sensitive-path exclusion (refuseToAccess() blocklist) applied by the file API, creating an inconsistency in access controls across API surfaces. The issue is fixed in v3.8.1; no public exploit identified at time of analysis.
Path traversal in SiYuan's asset.upload MCP tool before v3.8.1 allows an attacker to exfiltrate arbitrary host files - including SSH keys and credentials - by supplying absolute paths that bypass workspace boundary validation. The attack is delivered via prompt injection against an AI Agent connected to SiYuan's MCP server, meaning exploitation depends on an AI agent processing attacker-controlled content. No public exploit or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (CVSS 4.0: 6.9) reflects the potential to read any file the SiYuan process can access.
Plugin integrity bypass in SiYuan before v3.7.4 allows attackers with same-origin access to overwrite trusted, installed plugins by exploiting the bazaar install endpoint's failure to verify that the downloaded package content matches the caller-supplied packageName. By pairing a legitimate plugin's packageName with an attacker-controlled repoURL, an adversary substitutes malicious plugin code that persists across application restarts, achieving durable code execution within the SiYuan application context. No public exploit code or active exploitation has been identified at time of analysis, but the persistence mechanism elevates the practical impact beyond the moderate CVSS score.
Incomplete path blocklist in SiYuan's MCP file tool (versions before v3.8.0) allows authenticated administrators to read workspace files that the HTTP API is designed to protect, including plaintext publish-mode passwords from data/.siyuan/publishAccess.json. The flaw stems from a mismatch between the HTTP API's access restrictions and the MCP tool's narrower blocklist, classified as CWE-863 (Incorrect Authorization). No public exploit is identified at time of analysis; exploitation is bounded by the requirement for pre-existing administrator credentials.
Secret exfiltration via URL parameter interpolation in SiYuan's http_request MCP tool affects all versions before v3.8.0. An MCP client with elevated access can embed secret placeholder references directly in the destination URL of an http_request tool call, causing SiYuan to resolve and transmit stored plaintext secrets to any attacker-controlled host without user confirmation. No public exploit has been identified at time of analysis, but the exploitation mechanism is straightforward for any party holding MCP client access.
Full-read SSRF in SiYuan before v3.7.4 allows authenticated attackers to bypass the SafeMode SSRF guard by supplying URLs whose hostnames resolve to IPv6 transition addresses - NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32) - which encode private IPv4 destinations that the isPrivateIP function in kernel/util/net.go fails to classify as internal. Because the affected forward proxy, WebSocket proxy, and SSE proxy endpoints return the full response body, a successful bypass enables exfiltration of cloud instance metadata credentials (e.g., from 169.254.169.254), enumeration of internal services, and port-scanning of internal infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVE description provides sufficient technical specificity to serve as an exploit development roadmap.
Insufficient access control on the /api/lute/spinBlockDOM endpoint in SiYuan before v3.7.4 allows any authenticated low-privilege user (RoleEditor or RoleReader) to invoke a DOM-transformation API that should be admin-only, and to trigger endpoint starvation by submitting large payloads that monopolize the per-path mutex. The CVSS 4.0 base score is 5.3 (Medium), reported by VulnCheck with a fix available in v3.7.4. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in SiYuan's CheckAuth() session-cookie authentication branch affects all versions before 3.7.4, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. The session-cookie code path neither validates Origin nor Referer headers, and omits an explicit SameSite attribute on session cookies, leaving browser-default SameSite policies as the sole defense - a gap exploitable via a crafted malicious page when the victim has an active authenticated session. The CVSS 4.0 score of 2.3 reflects genuinely constrained real-world risk; no public exploit has been identified and no active exploitation is confirmed.
Information disclosure and authentication bypass in SiYuan before v3.7.4 allows unauthenticated remote attackers to enumerate the existence and access tier of any document by exploiting observable behavioral differences in the `/api/filetree/authFilePublishAccess` endpoint. Beyond mere enumeration, the flaw carries a more severe secondary impact: because hidden and forbidden document tiers are stored with an empty password, submitting an empty-password request against those documents causes the server to issue a valid publish-auth cookie, granting the anonymous caller direct access to content the document owner explicitly restricted. No public exploit code has been identified at time of analysis.
The getAttributeViewBacklinks endpoint in SiYuan before v3.7.4 leaks hidden document metadata to unauthenticated network attackers due to a logic error that applies the wrong access control list during backlink filtering. By supplying a publicly visible database row identifier, anonymous users receive the database name, row title, and full document path of hidden-tier documents that reference that row - bypassing the visibility list entirely. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity network vector means any internet-exposed SiYuan instance is trivially interrogable.
SiYuan personal knowledge management software before v3.7.4 exposes block identifiers from restricted and password-protected documents via the unauthenticated `getRefIDsByFileAnnotationID` API endpoint, which processes annotation-to-block lookups without any publish-access authorization check. Remote unauthenticated attackers who can observe PDF annotation identifiers on published pages can query this endpoint to enumerate citation relationships spanning documents intended to be inaccessible, leaking structural metadata about restricted content. This CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the CVSS 4.0 AV:N/AC:L/PR:N/UI:N vector indicates the flaw is trivially reachable with no authentication prerequisite.
Missing authorization on SiYuan's /api/ref/refreshBacklink endpoint exposes instances prior to v3.7.4 to unauthenticated server-side write operations. Any network-accessible anonymous user can supply an attacker-controlled block ID to flush transaction queues, trigger global reference scans, and enqueue database writes, bypassing the application's read-only access controls. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make this a viable target for resource amplification abuse.
The getLocalStorage API endpoint in SiYuan before v3.7.4 exposes the administrator's full local storage map to unauthenticated network callers and publish readers, with only three keys redacted by an incomplete sanitization filter. Sensitive operational metadata - including closed-tab history, search keywords, private document identifiers, and expanded folder paths - can be harvested in a single unauthenticated HTTP request against any network-accessible instance. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity attack path means any internet-exposed SiYuan deployment running a version below 3.7.4 is trivially reachable.
The getBookmarkLabels API endpoint in SiYuan before v3.7.4 exposes all workspace bookmark labels to unauthenticated and publish-mode readers due to missing authorization checks (CWE-862), leaking organizational metadata - topic taxonomy, project labels, and subject-matter vocabulary - from documents the requester cannot otherwise access. Any network-reachable SiYuan instance prior to v3.7.4 is affected regardless of publish-mode configuration, as the endpoint applies no access-control filtering. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; risk is primarily reconnaissance-enabling intelligence disclosure rather than direct data exfiltration.
Unauthorized document outline disclosure in SiYuan before v3.7.4 exposes heading identifiers for any document to unauthenticated network callers via the `/api/storage/getOutlineStorage` endpoint, which performs no authorization verification whatsoever. Affected are all SiYuan deployments (cpe:2.3:a:siyuan-note:siyuan:*) configured to listen on externally reachable interfaces running any version prior to v3.7.4. No public exploit has been identified at time of analysis, though the attack requires no credentials and is trivially automatable - any caller who supplies a document identifier retrieves its structural outline regardless of document-level access restrictions.
Unauthenticated access to the /api/block/getRefIDs endpoint in SiYuan before v3.7.4 exposes block reference metadata from password-protected documents, allowing remote attackers without any credentials to enumerate internal document structures. The endpoint fails to enforce the document-level password tier before returning block identifiers, meaning the password protection on sensitive documents is effectively bypassed for this API route. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in v3.7.4 per the GitHub Security Advisory GHSA-vg99-7gj7-2fr5.
Unauthenticated filesystem reconnaissance in SiYuan versions before v3.7.4 allows any network-reachable anonymous reader to probe arbitrary absolute paths on the host via the `getUniqueFilename` endpoint, which performs no authorization check or path confinement before returning existence results. The missing authorization control (CWE-862) means the attack requires zero credentials and zero user interaction against any exposed SiYuan HTTP interface, enabling structured enumeration of filesystem layout, installed software, and sensitive path locations as a precursor to more targeted attacks. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-barrier exploitation profile makes pre-attack reconnaissance trivially achievable against internet-exposed or LAN-accessible instances.
PDF annotation content in SiYuan through v3.7.2 is exposed without authorization via the /api/asset/getFileAnnotation endpoint, which applies only the generic CheckAuth middleware rather than the publish-access controls enforced on the /assets/* route. When publish authentication is disabled, anonymous readers can retrieve .sya annotation files containing private highlights and notes from password-protected, unpublished, or publish-forbidden documents simply by knowing a valid asset path; authenticated publish RoleReaders face the same missing check. The CVSS 4.0 score of 6.9 reflects a network-accessible, unauthenticated vector with limited scope - encrypted notebooks are not affected - and no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in SiYuan's publish layer exposes password-protected attribute view data to unauthenticated remote users across all versions before v3.7.4. The FilterViewByPublishAccess filter omits its password enforcement on the renderAttributeView code path, allowing arbitrary callers to retrieve structured database rows - including document titles, block IDs, and column values - from documents the owner intended to gate with a publish password. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; vendor patch is available at v3.7.4.
Unauthorized information disclosure in SiYuan exposes protected document metadata and content snippets via three unenforced API endpoints - getBlockBreadcrumb, getRefText, and getBlockTreeInfos - in all versions before v3.7.4. Unauthenticated network actors or low-privilege RoleReader accounts can bypass publish-access controls on documents explicitly marked as publish-forbidden or password-protected, retrieving titles, ancestor block content snippets, reference text, and path metadata by supplying block IDs. No public exploit has been identified at time of analysis; vendor patch is available in v3.7.4.
Unauthenticated information disclosure in SiYuan versions before 3.7.4 allows retrieval of block attributes - names, aliases, memos, and custom fields - from documents protected by publish-access controls. The `getBlockAttrs` and `batchGetBlockAttrs` API endpoints accept POST requests with block IDs without verifying the caller's authorization against the parent document's access policy, directly bypassing the publish-access restriction (CWE-862). No active exploitation has been confirmed and no public proof-of-concept has been identified; impact is bounded to metadata exposure rather than full document content, but the unauthenticated network vector warrants prompt patching for internet-exposed instances.
Information disclosure in SiYuan before v3.7.4 allows unauthenticated remote attackers to retrieve the server's absolute filesystem workspace path, operating-system username, and installation layout by querying the resolveAssetPath endpoint with relative asset paths harvested from published documents. The endpoint enforces only a lightweight CheckAuth gate rather than full authentication, satisfying CWE-639's authorization bypass pattern, and returns raw absolute paths to any network-reachable caller. Vendor patch v3.7.4 has been released; no active exploitation has been confirmed and no public proof-of-concept code has been identified at time of analysis.
Missing authorization controls on three internal API endpoints in SiYuan before v3.7.4 allow callers operating within the publish context to retrieve database column schemas, template expressions, select vocabularies, and workspace-wide block identifiers that were never intended to cross publish access boundaries. The affected endpoints - getAttributeViewKeysByID, getBlockDefIDsByRefText, and getBlockRelevantIDs - perform their operations without consulting publish-scoped permission checks, constituting a CWE-862 (Missing Authorization) flaw. A vendor patch is available at v3.7.4, no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Five path-resolution API endpoints in SiYuan's publish mode fail to enforce access controls, allowing unauthenticated or minimally-authenticated readers to enumerate the complete private document tree. Affected versions are all SiYuan releases up to and including v3.7.2; v3.7.4 contains the fix. An attacker targeting a SiYuan instance running in publish mode with Publish.Auth.Enable set to false can call getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath without any credentials to recover notebook names, folder hierarchies, document titles, and document IDs - including for content explicitly marked hidden, password-protected, or publish-forbidden. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes encrypted notebook identifiers, names, and memory-resident unlock states via the getEncryptedNotebookStatus API endpoint without enforcing publish-access filtering. Any anonymous or publish-mode client that can reach the instance can enumerate the full list of encrypted notebooks and determine which are actively decrypted in server memory, leaking sensitive organizational metadata. No public exploit has been identified and no CISA KEV listing exists; a vendor-released patch is available in v3.7.4.
Static-route access control bypass in SiYuan before v3.7.4 allows attackers to read sensitive workspace data by directly accessing file-serving routes that skip the authorization checks enforced on the REST API. Affected deployments include any SiYuan instance operating in disabled-auth mode (anonymous access) or where publish reader tokens have been issued, as those token holders can reach templates, snippets, and export artifacts without restriction. No public exploit or active exploitation has been identified at time of analysis, but the patch to v3.7.4 is available and should be applied promptly given the unauthenticated attack vector in disabled-auth configurations.
SiYuan's /api/tag/getTag endpoint leaks tag labels and occurrence counts from password-protected documents to any unauthenticated network caller, constituting an authorization bypass under CWE-863. All SiYuan versions before 3.7.4 are affected, as confirmed by a vendor GitHub Security Advisory (GHSA-mp7r-57w4-5qm3) and the EUVD entry EUVD-2026-57452. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the zero-friction network exploitability (PR:N, AC:L, UI:N) means any attacker with network reach can enumerate protected document vocabulary with a single API call.
Information disclosure in SiYuan v3.7.4-alpha.1 (pre-release only) permits any caller who passes basic authentication to retrieve complete database view metadata - including view names, icons, layout types, and per-field Hidden flags - for arbitrary database blocks by supplying an avID, regardless of their access level. The `/api/av/getAttributeViewFieldViews` endpoint introduced in commit acfc02ee8 applies `CheckAuth` middleware but omits any ownership or publish-access filter, producing a CWE-862 Missing Authorization condition. The vulnerability was corrected in the v3.7.4 stable release; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes notebook metadata - including names, document counts, storage sizes, and timestamps - for closed and non-published notebooks via the /api/notebook/getNotebookInfo endpoint, which performs no authorization check. Any attacker with network access to the SiYuan API can enumerate structural information that the application's access control model explicitly intends to hide from readers. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-friction, unauthenticated attack path makes this trivially exploitable wherever the API is internet- or network-exposed.
Information disclosure in SiYuan before v3.7.4 exposes administrator workspace state to unauthenticated network attackers via an improperly protected getConf API endpoint. The UILayout filter fails to enforce authorization boundaries between publish readers and the administrative configuration layer, leaking open document names, recent search terms, notebook directory paths, and private asset locations. No public exploit code or CISA KEV listing exists at time of analysis; however, the unauthenticated network vector makes the flaw trivially reachable on any internet-exposed SiYuan instance with publish features active.
Metadata disclosure in SiYuan before v3.7.3 exposes document titles, notebook paths, root IDs, and icons for administrator-restricted documents via the unauthenticated `/api/block/getBlockInfo` endpoint. The publish-access control flag is never checked server-side before returning document root metadata, making this a complete bypass of SiYuan's per-document publish exclusion feature. No public exploit is identified at time of analysis and no KEV listing exists, but the CVSS 4.0 vector (PR:N, AC:L) confirms exploitation requires no credentials and no special conditions against the network-facing API.
Credential file exfiltration in SiYuan prior to 3.7.1 is possible through the POST /api/file/globalCopyFiles endpoint, which accepts arbitrary absolute source paths and relies on an incomplete denylist in util.IsSensitivePath to block sensitive files. The denylist omits common credential files including .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, enabling an authenticated administrator or API-token holder to copy these files into the workspace and read them via the file API. No public exploit code or CISA KEV listing exists at time of analysis, but the Docker tag suggests this is relevant in containerized deployments where host-mounted credential files may be accessible.
Missing authorization on the `/api/storage/getCriteria` endpoint in SiYuan personal knowledge management software exposes saved search criteria - including private document paths, notebook and block IDs, and search/replace keyword history - to any publish-mode Reader, bypassing the access controls applied by all sibling storage endpoints. All SiYuan releases prior to 3.7.1 are affected per the vendor security advisory GHSA-px3c-cf92-9g83. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the low attack complexity and readily available fix commit make this straightforward to weaponize against exposed instances.
SiYuan's personal knowledge management system prior to 3.7.0 exposes all user note content to unauthenticated database exfiltration through a deliberately auth-excluded API endpoint. The `/api/icon/getDynamicIcon` endpoint, when invoked with `type=8` and a valid block ID, renders a Go template that executes arbitrary SELECT queries against SiYuan's SQLite backend via `querySQL` and `queryBlocks` functions - functions designed for note querying but reachable without any credential check. An attacker with network adjacency who possesses a valid block ID can read the entire database: note content, tags, asset references, and block attributes. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H rating reflects the block ID prerequisite. A fix is available in version 3.7.0.
SiYuan 3.6.1 through 3.6.3 allows arbitrary code execution when users view malicious bazaar packages in the marketplace UI. The vulnerability stems from an incomplete XSS fix (for CVE-2026-33066) that enabled an HTML sanitizer but failed to block iframe tags with srcdoc attributes containing embedded scripts. A malicious package author can inject JavaScript that executes in the Electron process with full application privileges, compromising the user's machine. The issue is confirmed fixed in version 3.6.4 and no public exploitation has been reported at time of analysis.
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chrome/Chromium browser extension obtain RoleAdministrator access to the local kernel HTTP server at 127.0.0.1:6806. Because the kernel unconditionally trusts all chrome-extension:// origins and desktop installs ship with an empty AccessAuthCode by default, a malicious or supply-chain-compromised extension can issue fully authenticated admin API calls with no further authentication, enabling data exfiltration, stored XSS injection, and configuration tampering. Publicly available exploit code exists; there is no public exploit identified as actively exploited.
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a synced workspace plant a CSS snippet whose '</style>' sequence breaks out of the surrounding <style> tag when renderSnippet() interpolates it via insertAdjacentHTML, running arbitrary JavaScript in the renderer. On Electron desktop builds the renderer runs with nodeIntegration:true, so the injected handler can reach require('child_process') and escalate the XSS to full host remote code execution. The payload syncs through the workspace repository and fires automatically on every device that pulls, and it bypasses the user's enabledJS=off setting; no public exploit or CISA KEV listing is identified at time of analysis.
Arbitrary file disclosure in SiYuan personal knowledge management system before 3.7.0 lets an unauthenticated remote attacker read any file inside the workspace directory through its publish-mode HTTP endpoint (default port 6808). The flaw is an incomplete fix for CVE-2026-41894: the earlier patch sanitized the /export/ route but left the identical double-URL-encoding path traversal in the /assets/*path route, exposing conf/conf.json (AccessAuthCode SHA256 hash, API token, sync keys), the temp SQLite databases, and siyuan.log. Publicly available exploit code exists; no public active exploitation has been confirmed.
Stored cross-site scripting in SiYuan's Bazaar marketplace (versions 2.1.12 through 3.6.x) enables arbitrary code execution on the host system. The vulnerability stems from unescaped package author metadata rendering, which when exploited through a malicious marketplace package, allows attackers to leverage SiYuan's insecure Electron configuration (nodeIntegration enabled, contextIsolation disabled) to execute Node.js APIs and OS-level commands. No public exploit or active exploitation confirmed at time of analysis. CVSS 8.3 with high attack complexity and required user interaction suggests real-world exploitation depends on convincing users to view crafted marketplace entries.
Directory traversal in SiYuan personal knowledge management system allows authenticated attackers to read arbitrary workspace files via double URL encoding bypass. The vulnerability stems from an incomplete fix for CVE-2026-30869 that added only denylist validation without removing a redundant url.PathUnescape() call in serveExport(). Attackers can use %252e%252e encoding to access sensitive files including the complete SQLite database (siyuan.db), kernel logs, and all user documents. EPSS data not available for this recent CVE; publicly available exploit code exists (GitHub commit demonstrates exploitation technique).
Authenticated local users can execute arbitrary code on Windows, macOS, and Linux via HTML injection in SiYuan desktop notification messages through version 3.6.4. The Electron-based desktop application mishandles notification rendering with unsafe settings (nodeIntegration enabled, contextIsolation disabled, webSecurity disabled), escalating XSS to full system compromise. Vendor-released patch available in version 3.6.5. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Remote code execution in SiYuan desktop client (Electron-based) versions prior to 3.6.4 allows authenticated attackers to execute arbitrary code on victim systems via malicious notes propagated through workspace sync. Stored XSS in table caption fields escalates to RCE due to nodeIntegration enabled and contextIsolation disabled in Electron renderer. CVSS 9.0 (Critical) with scope change indicates escape from browser context. No active exploitation confirmed (not in CISA KEV). EPSS score 0.14% suggests low current exploitation probability. Vendor-released patch: version 3.6.4.
SiYuan knowledge management system versions 3.6.0 and below allow unauthenticated WebSocket connections to the /ws endpoint via specific URL parameters, enabling attackers to bypass authentication and receive real-time server push events. An attacker can exploit this by connecting from a malicious website to monitor a victim's local SiYuan instance and exfiltrate sensitive metadata including document titles, notebook names, file paths, and user activity without the victim's knowledge. No patch is currently available for this high-severity information disclosure vulnerability.
SQL injection in the SiYuan note-taking kernel's history search handlers (all builds up to and including v3.8.6) lets anyone holding a valid admin API token read the contents of history.db beyond what the history API is meant to expose, including content, titles and paths of previously deleted documents. The flaw is privileged rather than remote-unauthenticated: the actor must already possess the workspace admin token, obtain it from ws/conf/conf.json, complete the login flow, or operate inside a client that holds it, such as a malicious plugin or the MCP history tool. Impact is read-only confidentiality loss against history.db - no integrity or availability effect - and the vendor advisory ships a reproduction that was validated against a source-built v3.8.6 kernel; no confirmed active exploitation (CISA KEV) was reported and the priority label is this_month.
Stored cross-site scripting in SiYuan Note 2.10.0 through 3.8.6 lets a user who already holds edit permission on a document plant a `javascript:` URL inside math-block content, for example `$$\href{javascript:alert('xss')}{clickme}$$`, so that script runs in the application origin when a reader clicks the rendered link. The rendering path passes math TeX to KaTeX with `trust: true` and mounts the resulting HTML through `innerHTML`, so `\href`, `\url` and `\includegraphics` payloads (including mixed-case `JaVaScRiPt:` schemes) survive unsanitized. Exploitation is not unauthenticated and is not automatic: the attacker needs writer access to a shared document and the victim must open it and click, which caps practical severity at CVSS 5.1; the vendor advisory GHSA-hhvq-jqv9-pgjq includes a detailed proof-of-concept reproduction against a real Chromium instance, though no CISA KEV listing or public weaponized exploit is reported, and the priority label is this_month.
SiYuan's MCP asset tool fails to block dotenv-style secret files, so an attacker who can drive an authenticated MCP client can copy a file such as ~/.env from the server host into the workspace and then read it back over HTTP from /assets/. The flaw is an incomplete fix of GHSA-p23f-cm6q-2qp8: the sensitive-path check is a 17-entry home-dotfile blacklist (.ssh, .aws, .kube, .docker, .gnupg, .git-credentials, credentials*, id_*) that omits .env, .env.local, .env.production, ~/Library, other users' home directories and Windows AppData. Public proof-of-concept reproduction steps exist and were executed against a self-hosted SiYuan 3.8.6 lab; because the MCP server must be exposed and the attacker needs a valid SiYuan API token, the issue is a moderate, not emergency, priority (this_month).
Absolute path traversal in the SiYuan kernel's private plugin HTTP server (SiYuan 3.7.0 through 3.8.5) allows an attacker-supplied kernel plugin to read any file readable by the SiYuan process, including the API token and conf.json, by returning an absolute path in its handler's ResponseFile.Path that the kernel passes unvalidated to gin's Context.File. The plugin's private endpoint requires no authentication or privileges to reach (PR:N), but the CVSS 4.0 vector carries UI:A and our assessment confirms the decisive precondition is user action: a victim must install and load a malicious third-party kernel plugin, so a default installation is not exposed on its own. No public exploit identified at time of analysis and the issue is not in CISA KEV; vendor-released patch is SiYuan 3.8.6, which rejects any path resolving outside the workspace.
Information disclosure in SiYuan before 3.8.5 allows publish-mode readers to extract backlink block IDs (refIDs) and reference counts (refCount) belonging to password-protected or publish-disabled documents by POSTing a published document ID to /api/block/getDocInfo or /api/block/getDocsInfo. The attacker only needs network reachability to the publish endpoint and knowledge of a valid published document ID - no authentication is required per the CVSS vector (PR:N) - and the exposed data is metadata about hidden referencing blocks rather than the protected documents' content. Exploitation requires the instance to actually be running in publish mode with at least one published document that is referenced by a protected or unpublished note; there is no public exploit identified at time of analysis, and a vendor fix is available in SiYuan 3.8.5.
Metadata disclosure in the SiYuan note-taking and publishing platform before v3.8.5 allows unauthenticated remote attackers to learn details about documents that the publisher deliberately excluded from the public view. By querying the getNotebookInfo endpoint against a publish-visible notebook, an attacker - including an anonymous visitor whenever no reader password is configured - can retrieve the document count, storage size, and modification timestamps of hidden (publish-excluded) documents. This is a genuine but modest-severity exposure (assessed CVSS 3.1 base 5.3, C/L only, no integrity or availability impact) rather than a high-urgency priority; no public exploit has been identified at time of analysis, and a vendor patch is available in v3.8.5. The most consequential aspect is the information leak itself: counts, sizes, and timestamps can reveal the existence, volume, and edit cadence of private material.
SiYuan before v3.8.5 allows unauthenticated publish visitors to learn unpublished notebook box IDs through missing authorization in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time. This medium-severity information disclosure requires the Publish feature to be enabled and reachable; no public exploit code has been identified at time of analysis, and vendor patch v3.8.5 is available.
Information disclosure in SiYuan before v3.8.4 allows publish readers to retrieve image asset paths and filenames from attribute-view (database) rows that the publish configuration should have hidden. The getCurrentAttrViewImages endpoint skips the database-level publish-access check that its sibling rendering endpoint enforces, so an attacker who first obtains an unrendered database identifier from a related endpoint can supply it as avID and receive asset paths for detached rows. The flaw is remotely reachable without authentication (CVSS PR:N) and rated CVSS 6.9 (confidentiality-only, low impact); no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the vendor has released v3.8.4 to correct it.
Cross-workspace denial of service in the SiYuan desktop (Electron) app lets a renderer that is connected to an attacker-controlled remote kernel broadcast a lockscreen command through the 'siyuan-send-windows' IPC handler, locking unrelated local workspace windows. The vulnerable handler does not validate the IPC sender or restrict recipients, so it forwards the payload to every window returned by BrowserWindow.getAllWindows(); sibling windows configured with lockScreenMode=1 invoke lockScreen() on receipt, and repeat messages keep those windows locked. Per the CVSS 4.0 vector the IPC path requires no privileges (PR:N) but does require user interaction (UI:P) - the victim must have multiple workspaces open and must have connected one renderer to the hostile kernel - and impact is availability-only, recoverable by manually unlocking; no public exploit code has been identified at time of analysis.
SiYuan versions through 3.8.4 fail to enforce authorization on the getDynamicIcon endpoint, allowing authenticated attackers holding a read-only publish token to disclose metadata-such as block titles, names, aliases, and hierarchical paths-of restricted documents via a template injection triggered by type=8 requests. The flaw is rated medium severity (vendor CVSS 5.3, independent CVSS 3.1 5.3) and impacts confidentiality only; no public exploit or active exploitation has been identified at time of analysis.
Information disclosure in Siyuan note-taking software before v3.8.2 allows unauthenticated publish-mode readers to probe the existence and quantity of private or unpublished content via the full-text search API. The POST /api/search/fullTextSearchBlock endpoint correctly withholds actual block content from hidden documents but leaks unfiltered match counts - the number of matching blocks and pages - enabling attackers to use the search API as an oracle to systematically map the structure of private content without ever seeing it. No public exploit code has been identified at time of analysis, and the vendor has released a patch in v3.8.2.
SiYuan's `getAttributeViewKeysByID` endpoint, present in all versions before v3.8.2, allows authenticated publish readers to retrieve full key schemas-including sensitive field names and relation definitions-from private or hidden databases they have no visibility into. The flaw is an authorization bypass (CWE-639/IDOR) where the endpoint validates that a caller holds a publish-reader session but never verifies the caller's access rights against the parent database owning the requested attribute view. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk moderate despite the network-accessible attack vector.
Authenticated readers in SiYuan v3.8.1 can call the POST /api/transactions/undoState endpoint with a known document root ID to retrieve internal root IDs of other documents - including private or unpublished ones - that participated in the same cross-document transaction. The flaw is CWE-639 (IDOR via user-controlled key): the endpoint reads from the global undo-log stack and returns peekMutatedRootIDs without applying publish-access visibility filtering to the returned identifiers. Document body contents are not exposed; however, internal identifiers and cross-document transaction relationships leak across trust boundaries. Vendor-released patch v3.8.2 resolves the issue; no public exploit or CISA KEV listing is known at time of analysis.
SiYuan's publish mode before v3.8.1 leaks invisible-tier content to unauthenticated readers through three unguarded rendering pathways: SQL embed blocks, attribute-view keys, and attribute-view backlinks. Administrators who mark notes as invisible to control what anonymous visitors see receive no protection - those same visitors can enumerate the hidden content by exploiting any of the three listing mechanisms. No active exploitation has been identified (no CISA KEV listing, no public POC), and the vendor has released a fix in v3.8.1.
Authenticated administrators in SiYuan before v3.8.1 can bypass the IsForbiddenAbsPath security guard - introduced to remediate GHSA-c8r8-95hg-mp34 - by targeting the /history/*path and /repo/diff/*path API endpoints, which construct file paths independently and were never covered by the guard. Exploitation enables retrieval of historical file snapshots including data/.siyuan/publishAccess.json, which stores plaintext publish-mode passwords, and files under data/templates/. No public exploit identified at time of analysis; the vendor-released patch is v3.8.1.
Path traversal in SiYuan 3.8.0 allows an authenticated attacker to read arbitrary files within the workspace directory via the POST /api/template/render endpoint, including conf/conf.json, which contains the API token and cookie signing key. The RenderTemplate function enforces only a workspace-boundary check (util.IsAbsPathInWorkspace) but omits the sensitive-path exclusion (refuseToAccess() blocklist) applied by the file API, creating an inconsistency in access controls across API surfaces. The issue is fixed in v3.8.1; no public exploit identified at time of analysis.
Path traversal in SiYuan's asset.upload MCP tool before v3.8.1 allows an attacker to exfiltrate arbitrary host files - including SSH keys and credentials - by supplying absolute paths that bypass workspace boundary validation. The attack is delivered via prompt injection against an AI Agent connected to SiYuan's MCP server, meaning exploitation depends on an AI agent processing attacker-controlled content. No public exploit or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (CVSS 4.0: 6.9) reflects the potential to read any file the SiYuan process can access.
Plugin integrity bypass in SiYuan before v3.7.4 allows attackers with same-origin access to overwrite trusted, installed plugins by exploiting the bazaar install endpoint's failure to verify that the downloaded package content matches the caller-supplied packageName. By pairing a legitimate plugin's packageName with an attacker-controlled repoURL, an adversary substitutes malicious plugin code that persists across application restarts, achieving durable code execution within the SiYuan application context. No public exploit code or active exploitation has been identified at time of analysis, but the persistence mechanism elevates the practical impact beyond the moderate CVSS score.
Incomplete path blocklist in SiYuan's MCP file tool (versions before v3.8.0) allows authenticated administrators to read workspace files that the HTTP API is designed to protect, including plaintext publish-mode passwords from data/.siyuan/publishAccess.json. The flaw stems from a mismatch between the HTTP API's access restrictions and the MCP tool's narrower blocklist, classified as CWE-863 (Incorrect Authorization). No public exploit is identified at time of analysis; exploitation is bounded by the requirement for pre-existing administrator credentials.
Secret exfiltration via URL parameter interpolation in SiYuan's http_request MCP tool affects all versions before v3.8.0. An MCP client with elevated access can embed secret placeholder references directly in the destination URL of an http_request tool call, causing SiYuan to resolve and transmit stored plaintext secrets to any attacker-controlled host without user confirmation. No public exploit has been identified at time of analysis, but the exploitation mechanism is straightforward for any party holding MCP client access.
Full-read SSRF in SiYuan before v3.7.4 allows authenticated attackers to bypass the SafeMode SSRF guard by supplying URLs whose hostnames resolve to IPv6 transition addresses - NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32) - which encode private IPv4 destinations that the isPrivateIP function in kernel/util/net.go fails to classify as internal. Because the affected forward proxy, WebSocket proxy, and SSE proxy endpoints return the full response body, a successful bypass enables exfiltration of cloud instance metadata credentials (e.g., from 169.254.169.254), enumeration of internal services, and port-scanning of internal infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVE description provides sufficient technical specificity to serve as an exploit development roadmap.
Insufficient access control on the /api/lute/spinBlockDOM endpoint in SiYuan before v3.7.4 allows any authenticated low-privilege user (RoleEditor or RoleReader) to invoke a DOM-transformation API that should be admin-only, and to trigger endpoint starvation by submitting large payloads that monopolize the per-path mutex. The CVSS 4.0 base score is 5.3 (Medium), reported by VulnCheck with a fix available in v3.7.4. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in SiYuan's CheckAuth() session-cookie authentication branch affects all versions before 3.7.4, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. The session-cookie code path neither validates Origin nor Referer headers, and omits an explicit SameSite attribute on session cookies, leaving browser-default SameSite policies as the sole defense - a gap exploitable via a crafted malicious page when the victim has an active authenticated session. The CVSS 4.0 score of 2.3 reflects genuinely constrained real-world risk; no public exploit has been identified and no active exploitation is confirmed.
Information disclosure and authentication bypass in SiYuan before v3.7.4 allows unauthenticated remote attackers to enumerate the existence and access tier of any document by exploiting observable behavioral differences in the `/api/filetree/authFilePublishAccess` endpoint. Beyond mere enumeration, the flaw carries a more severe secondary impact: because hidden and forbidden document tiers are stored with an empty password, submitting an empty-password request against those documents causes the server to issue a valid publish-auth cookie, granting the anonymous caller direct access to content the document owner explicitly restricted. No public exploit code has been identified at time of analysis.
The getAttributeViewBacklinks endpoint in SiYuan before v3.7.4 leaks hidden document metadata to unauthenticated network attackers due to a logic error that applies the wrong access control list during backlink filtering. By supplying a publicly visible database row identifier, anonymous users receive the database name, row title, and full document path of hidden-tier documents that reference that row - bypassing the visibility list entirely. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity network vector means any internet-exposed SiYuan instance is trivially interrogable.
SiYuan personal knowledge management software before v3.7.4 exposes block identifiers from restricted and password-protected documents via the unauthenticated `getRefIDsByFileAnnotationID` API endpoint, which processes annotation-to-block lookups without any publish-access authorization check. Remote unauthenticated attackers who can observe PDF annotation identifiers on published pages can query this endpoint to enumerate citation relationships spanning documents intended to be inaccessible, leaking structural metadata about restricted content. This CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the CVSS 4.0 AV:N/AC:L/PR:N/UI:N vector indicates the flaw is trivially reachable with no authentication prerequisite.
Missing authorization on SiYuan's /api/ref/refreshBacklink endpoint exposes instances prior to v3.7.4 to unauthenticated server-side write operations. Any network-accessible anonymous user can supply an attacker-controlled block ID to flush transaction queues, trigger global reference scans, and enqueue database writes, bypassing the application's read-only access controls. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make this a viable target for resource amplification abuse.
The getLocalStorage API endpoint in SiYuan before v3.7.4 exposes the administrator's full local storage map to unauthenticated network callers and publish readers, with only three keys redacted by an incomplete sanitization filter. Sensitive operational metadata - including closed-tab history, search keywords, private document identifiers, and expanded folder paths - can be harvested in a single unauthenticated HTTP request against any network-accessible instance. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity attack path means any internet-exposed SiYuan deployment running a version below 3.7.4 is trivially reachable.
The getBookmarkLabels API endpoint in SiYuan before v3.7.4 exposes all workspace bookmark labels to unauthenticated and publish-mode readers due to missing authorization checks (CWE-862), leaking organizational metadata - topic taxonomy, project labels, and subject-matter vocabulary - from documents the requester cannot otherwise access. Any network-reachable SiYuan instance prior to v3.7.4 is affected regardless of publish-mode configuration, as the endpoint applies no access-control filtering. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; risk is primarily reconnaissance-enabling intelligence disclosure rather than direct data exfiltration.
Unauthorized document outline disclosure in SiYuan before v3.7.4 exposes heading identifiers for any document to unauthenticated network callers via the `/api/storage/getOutlineStorage` endpoint, which performs no authorization verification whatsoever. Affected are all SiYuan deployments (cpe:2.3:a:siyuan-note:siyuan:*) configured to listen on externally reachable interfaces running any version prior to v3.7.4. No public exploit has been identified at time of analysis, though the attack requires no credentials and is trivially automatable - any caller who supplies a document identifier retrieves its structural outline regardless of document-level access restrictions.
Unauthenticated access to the /api/block/getRefIDs endpoint in SiYuan before v3.7.4 exposes block reference metadata from password-protected documents, allowing remote attackers without any credentials to enumerate internal document structures. The endpoint fails to enforce the document-level password tier before returning block identifiers, meaning the password protection on sensitive documents is effectively bypassed for this API route. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in v3.7.4 per the GitHub Security Advisory GHSA-vg99-7gj7-2fr5.
Unauthenticated filesystem reconnaissance in SiYuan versions before v3.7.4 allows any network-reachable anonymous reader to probe arbitrary absolute paths on the host via the `getUniqueFilename` endpoint, which performs no authorization check or path confinement before returning existence results. The missing authorization control (CWE-862) means the attack requires zero credentials and zero user interaction against any exposed SiYuan HTTP interface, enabling structured enumeration of filesystem layout, installed software, and sensitive path locations as a precursor to more targeted attacks. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-barrier exploitation profile makes pre-attack reconnaissance trivially achievable against internet-exposed or LAN-accessible instances.
PDF annotation content in SiYuan through v3.7.2 is exposed without authorization via the /api/asset/getFileAnnotation endpoint, which applies only the generic CheckAuth middleware rather than the publish-access controls enforced on the /assets/* route. When publish authentication is disabled, anonymous readers can retrieve .sya annotation files containing private highlights and notes from password-protected, unpublished, or publish-forbidden documents simply by knowing a valid asset path; authenticated publish RoleReaders face the same missing check. The CVSS 4.0 score of 6.9 reflects a network-accessible, unauthenticated vector with limited scope - encrypted notebooks are not affected - and no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in SiYuan's publish layer exposes password-protected attribute view data to unauthenticated remote users across all versions before v3.7.4. The FilterViewByPublishAccess filter omits its password enforcement on the renderAttributeView code path, allowing arbitrary callers to retrieve structured database rows - including document titles, block IDs, and column values - from documents the owner intended to gate with a publish password. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; vendor patch is available at v3.7.4.
Unauthorized information disclosure in SiYuan exposes protected document metadata and content snippets via three unenforced API endpoints - getBlockBreadcrumb, getRefText, and getBlockTreeInfos - in all versions before v3.7.4. Unauthenticated network actors or low-privilege RoleReader accounts can bypass publish-access controls on documents explicitly marked as publish-forbidden or password-protected, retrieving titles, ancestor block content snippets, reference text, and path metadata by supplying block IDs. No public exploit has been identified at time of analysis; vendor patch is available in v3.7.4.
Unauthenticated information disclosure in SiYuan versions before 3.7.4 allows retrieval of block attributes - names, aliases, memos, and custom fields - from documents protected by publish-access controls. The `getBlockAttrs` and `batchGetBlockAttrs` API endpoints accept POST requests with block IDs without verifying the caller's authorization against the parent document's access policy, directly bypassing the publish-access restriction (CWE-862). No active exploitation has been confirmed and no public proof-of-concept has been identified; impact is bounded to metadata exposure rather than full document content, but the unauthenticated network vector warrants prompt patching for internet-exposed instances.
Information disclosure in SiYuan before v3.7.4 allows unauthenticated remote attackers to retrieve the server's absolute filesystem workspace path, operating-system username, and installation layout by querying the resolveAssetPath endpoint with relative asset paths harvested from published documents. The endpoint enforces only a lightweight CheckAuth gate rather than full authentication, satisfying CWE-639's authorization bypass pattern, and returns raw absolute paths to any network-reachable caller. Vendor patch v3.7.4 has been released; no active exploitation has been confirmed and no public proof-of-concept code has been identified at time of analysis.
Missing authorization controls on three internal API endpoints in SiYuan before v3.7.4 allow callers operating within the publish context to retrieve database column schemas, template expressions, select vocabularies, and workspace-wide block identifiers that were never intended to cross publish access boundaries. The affected endpoints - getAttributeViewKeysByID, getBlockDefIDsByRefText, and getBlockRelevantIDs - perform their operations without consulting publish-scoped permission checks, constituting a CWE-862 (Missing Authorization) flaw. A vendor patch is available at v3.7.4, no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Five path-resolution API endpoints in SiYuan's publish mode fail to enforce access controls, allowing unauthenticated or minimally-authenticated readers to enumerate the complete private document tree. Affected versions are all SiYuan releases up to and including v3.7.2; v3.7.4 contains the fix. An attacker targeting a SiYuan instance running in publish mode with Publish.Auth.Enable set to false can call getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath without any credentials to recover notebook names, folder hierarchies, document titles, and document IDs - including for content explicitly marked hidden, password-protected, or publish-forbidden. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes encrypted notebook identifiers, names, and memory-resident unlock states via the getEncryptedNotebookStatus API endpoint without enforcing publish-access filtering. Any anonymous or publish-mode client that can reach the instance can enumerate the full list of encrypted notebooks and determine which are actively decrypted in server memory, leaking sensitive organizational metadata. No public exploit has been identified and no CISA KEV listing exists; a vendor-released patch is available in v3.7.4.
Static-route access control bypass in SiYuan before v3.7.4 allows attackers to read sensitive workspace data by directly accessing file-serving routes that skip the authorization checks enforced on the REST API. Affected deployments include any SiYuan instance operating in disabled-auth mode (anonymous access) or where publish reader tokens have been issued, as those token holders can reach templates, snippets, and export artifacts without restriction. No public exploit or active exploitation has been identified at time of analysis, but the patch to v3.7.4 is available and should be applied promptly given the unauthenticated attack vector in disabled-auth configurations.
SiYuan's /api/tag/getTag endpoint leaks tag labels and occurrence counts from password-protected documents to any unauthenticated network caller, constituting an authorization bypass under CWE-863. All SiYuan versions before 3.7.4 are affected, as confirmed by a vendor GitHub Security Advisory (GHSA-mp7r-57w4-5qm3) and the EUVD entry EUVD-2026-57452. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the zero-friction network exploitability (PR:N, AC:L, UI:N) means any attacker with network reach can enumerate protected document vocabulary with a single API call.
Information disclosure in SiYuan v3.7.4-alpha.1 (pre-release only) permits any caller who passes basic authentication to retrieve complete database view metadata - including view names, icons, layout types, and per-field Hidden flags - for arbitrary database blocks by supplying an avID, regardless of their access level. The `/api/av/getAttributeViewFieldViews` endpoint introduced in commit acfc02ee8 applies `CheckAuth` middleware but omits any ownership or publish-access filter, producing a CWE-862 Missing Authorization condition. The vulnerability was corrected in the v3.7.4 stable release; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes notebook metadata - including names, document counts, storage sizes, and timestamps - for closed and non-published notebooks via the /api/notebook/getNotebookInfo endpoint, which performs no authorization check. Any attacker with network access to the SiYuan API can enumerate structural information that the application's access control model explicitly intends to hide from readers. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-friction, unauthenticated attack path makes this trivially exploitable wherever the API is internet- or network-exposed.
Information disclosure in SiYuan before v3.7.4 exposes administrator workspace state to unauthenticated network attackers via an improperly protected getConf API endpoint. The UILayout filter fails to enforce authorization boundaries between publish readers and the administrative configuration layer, leaking open document names, recent search terms, notebook directory paths, and private asset locations. No public exploit code or CISA KEV listing exists at time of analysis; however, the unauthenticated network vector makes the flaw trivially reachable on any internet-exposed SiYuan instance with publish features active.
Metadata disclosure in SiYuan before v3.7.3 exposes document titles, notebook paths, root IDs, and icons for administrator-restricted documents via the unauthenticated `/api/block/getBlockInfo` endpoint. The publish-access control flag is never checked server-side before returning document root metadata, making this a complete bypass of SiYuan's per-document publish exclusion feature. No public exploit is identified at time of analysis and no KEV listing exists, but the CVSS 4.0 vector (PR:N, AC:L) confirms exploitation requires no credentials and no special conditions against the network-facing API.
Credential file exfiltration in SiYuan prior to 3.7.1 is possible through the POST /api/file/globalCopyFiles endpoint, which accepts arbitrary absolute source paths and relies on an incomplete denylist in util.IsSensitivePath to block sensitive files. The denylist omits common credential files including .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, enabling an authenticated administrator or API-token holder to copy these files into the workspace and read them via the file API. No public exploit code or CISA KEV listing exists at time of analysis, but the Docker tag suggests this is relevant in containerized deployments where host-mounted credential files may be accessible.
Missing authorization on the `/api/storage/getCriteria` endpoint in SiYuan personal knowledge management software exposes saved search criteria - including private document paths, notebook and block IDs, and search/replace keyword history - to any publish-mode Reader, bypassing the access controls applied by all sibling storage endpoints. All SiYuan releases prior to 3.7.1 are affected per the vendor security advisory GHSA-px3c-cf92-9g83. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the low attack complexity and readily available fix commit make this straightforward to weaponize against exposed instances.
SiYuan's personal knowledge management system prior to 3.7.0 exposes all user note content to unauthenticated database exfiltration through a deliberately auth-excluded API endpoint. The `/api/icon/getDynamicIcon` endpoint, when invoked with `type=8` and a valid block ID, renders a Go template that executes arbitrary SELECT queries against SiYuan's SQLite backend via `querySQL` and `queryBlocks` functions - functions designed for note querying but reachable without any credential check. An attacker with network adjacency who possesses a valid block ID can read the entire database: note content, tags, asset references, and block attributes. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H rating reflects the block ID prerequisite. A fix is available in version 3.7.0.
SiYuan 3.6.1 through 3.6.3 allows arbitrary code execution when users view malicious bazaar packages in the marketplace UI. The vulnerability stems from an incomplete XSS fix (for CVE-2026-33066) that enabled an HTML sanitizer but failed to block iframe tags with srcdoc attributes containing embedded scripts. A malicious package author can inject JavaScript that executes in the Electron process with full application privileges, compromising the user's machine. The issue is confirmed fixed in version 3.6.4 and no public exploitation has been reported at time of analysis.