B3log Siyuan
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in B3log Siyuan.
By the Year
In 2026 there have been 119 vulnerabilities in B3log Siyuan with an average score of 8.1 out of ten. Last year, in 2025 Siyuan had 1 security vulnerability published. That is, 118 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.03
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 119 | 8.07 |
| 2025 | 1 | 9.10 |
| 2024 | 10 | 7.43 |
It may take a day or so for new Siyuan vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent B3log Siyuan Security Vulnerabilities
SiYuan <=3.8.4 XSS via unescaped heading style attributes
CVE-2026-93923
8.6 - High
- September 18, 2026
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.
XSS
SiYuan 3.8.4 XSS via Daily Note Picker Unescaped Notebook Names in Electron
CVE-2026-93922
8.6 - High
- September 18, 2026
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.
XSS
SiYuan <=3.8.4 getDynamicIcon AC Bypass (ReadOnly Token)
CVE-2026-93921
5.3 - Medium
- September 18, 2026
SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.
AuthZ
SQLi in SiYuan <3.8.3 via graph.go query2Stmt (tag injection)
CVE-2026-93591
7.2 - High
- September 18, 2026
SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.
SQL Injection
SiYuan <=3.8.4 XSS via backlink title rendering in Electron
CVE-2026-92986
8.6 - High
- September 17, 2026
SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.
XSS
SiYuan <3.8.4 XSS via .sy Bookmark Labels (Exec)
CVE-2026-92985
8.6 - High
- September 17, 2026
SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.
XSS
SiYuan <v3.8.2: Authenticated Path Traversal via /api/riff/removeRiffDeck
CVE-2026-87815
8.4 - High
- September 09, 2026
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.
External Control of File Name or Path
SiYuan <3.8.2 Stored XSS via Search Asset Preview (innerHTML)
CVE-2026-87814
8.4 - High
- September 09, 2026
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYuan origin when victims preview the assets, enabling authenticated API requests and workspace manipulation.
XSS
SiYuan <3.8.2 XSS via Search Assets Filename Injection
CVE-2026-87813
8.4 - High
- September 09, 2026
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.
XSS
SiYuan <3.8.2 XSS via iconURL in Bazaar package cards
CVE-2026-87812
7.4 - High
- September 09, 2026
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated SiYuan origin when users view Bazaar listings, enabling API requests and application state manipulation.
XSS
SiYuan <3.8.2 XSS via unsanitized template path in notebook config
CVE-2026-87811
8.4 - High
- September 09, 2026
SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling same-origin API requests and application state manipulation.
XSS
Siyuan <3.8.2 Match Count Leak in /api/search/fullTextSearchBlock
CVE-2026-87810
6.9 - Medium
- September 09, 2026
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.
Information Disclosure
Siyuan 3.8.1 API: Publish-Access Filtering Exposed via Embedded Blocks
CVE-2026-87809
7.1 - High
- September 09, 2026
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.
Insecure Direct Object Reference / IDOR
SiYuan <=3.8.1 Full Text Search Block SQL Injection in Read-Only Mode
CVE-2026-87808
8.7 - High
- September 09, 2026
SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.
Protection Mechanism Failure
Siyuan <3.8.2 Authenticated SQLi in fullTextSearchBlock endpoint
CVE-2026-87807
8.7 - High
- September 09, 2026
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and sensitive attributes.
SQL Injection
SiYuan <3.8.2 Clipboard MIME Trust Exploit (Node.js Code Exec)
CVE-2026-86712
8.6 - High
- September 08, 2026
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.
XSS
SiYuan <v3.8.2 Unfiltered getAttributeViewKeys Exposes Private DB
CVE-2026-86192
7.1 - High
- September 05, 2026
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.
Insecure Direct Object Reference / IDOR
SiYuan < v3.8.2: Info Disclosure via getAttributeViewKeysByID
CVE-2026-86191
5.3 - Medium
- September 05, 2026
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.
Insecure Direct Object Reference / IDOR
SiYuan v<3.8.2 - Unbounded Request-Concurrency Resource Consumption (DoS)
CVE-2026-85585
8.7 - High
- September 04, 2026
SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.
Resource Exhaustion
SiYuan <3.8.2 DoS via Basic Auth Throttle Memory Exhaustion
CVE-2026-85584
8.7 - High
- September 04, 2026
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.
Allocation of Resources Without Limits or Throttling
SiYuan <3.8.2 Path Traversal via Symlink in Reader-Accessible Asset Endpoint
CVE-2026-85583
7.1 - High
- September 04, 2026
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.
insecure temporary file
SiYuan v<3.8.2 Unbounded Auth Session DoS
CVE-2026-85582
7.1 - High
- September 04, 2026
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.
Allocation of Resources Without Limits or Throttling
SiYuan <3.8.2 DoS: Unauthenticated /api/system/uiproc
CVE-2026-85581
8.7 - High
- September 04, 2026
SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.
Allocation of Resources Without Limits or Throttling
SiYuan <3.8.2 Path Guard Bypass in MCP Read Sensitive Configs
CVE-2026-85580
7.1 - High
- September 04, 2026
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata.
Directory traversal
SiYuan v3.8.1 Info Disclosure: /api/transactions/undoState leaks internal IDs
CVE-2026-85579
5.3 - Medium
- September 04, 2026
SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.
Insecure Direct Object Reference / IDOR
SiYuan <=3.8.1 Auth Bypass /api/file/getFile exposes private notebooks
CVE-2026-85578
7.1 - High
- September 04, 2026
SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.
AuthZ
SiYuan <=3.8.1 blocklist flaw leaks TLS keys
CVE-2026-85175
8.7 - High
- September 03, 2026
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
Files or Directories Accessible to External Parties
SiYuan <3.8.2 API Tokens Logged from Query Params - Auth Escalation
CVE-2026-85174
8.7 - High
- September 03, 2026
SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.
Insertion of Sensitive Information into Log File
SiYuan <3.8.2 XSS via asset serving: .xht/.rdf execution
CVE-2026-84803
8.6 - High
- September 02, 2026
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
XSS
SiYuan <3.8.1 XSS via block name/alias/memo rendering
CVE-2026-82654
9.3 - Critical
- August 30, 2026
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
XSS
SiYuan XSS in confirmDialog() before v3.8.1 via unescaped package name
CVE-2026-82653
9.3 - Critical
- August 30, 2026
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
XSS
SiYuan <3.8.1: SQL Embed & Attr-View Backlink Disclosure in Publish Mode
CVE-2026-82652
6.9 - Medium
- August 30, 2026
SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted.
Exposure of Resource to Wrong Sphere
SiYuan <3.8.1: /history/*path & /repo/diff/*path leak sensitive files
CVE-2026-82651
6.9 - Medium
- August 30, 2026
SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.
Information Disclosure
SiYuan 3.8.0 RenderTemplate Path Traversal Sensitive File Exposure, fixed 3.8.1
CVE-2026-82650
5.9 - Medium
- August 30, 2026
SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint (kernel/api/template.go). The endpoint restricts the supplied path only to the workspace directory (util.IsAbsPathInWorkspace) but, unlike the file API's refuseToAccess() blocklist, applies no sensitive-path exclusion. This allows an authenticated attacker to read sensitive workspace files, including conf/conf.json, which contains the API token and cookie signing key. The issue is fixed in v3.8.1.
Exposure of Resource to Wrong Sphere
SiYuan Windows NSIS <3.8.1 Uncontrolled Search Path LPE
CVE-2026-82649
7 - High
- August 30, 2026
SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a search path that includes the installer's own launch directory ahead of System32, an attacker who plants a malicious executable (e.g., a renamed TASKKILL.exe) in that directory can have it executed when the installer runs. These calls occur in electron-builder's preInit hook before the license page is displayed, and with an all-users (elevated) install the planted binary executes with an elevated token, resulting in local privilege escalation.
DLL preloading
SiYuan <3.8.1 SSRF via DNS Rebinding http_request & web_fetch (CVE-2026-82234)
CVE-2026-82234
8.4 - High
- August 28, 2026
SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services.
SSRF
SiYuan <3.8.1 Path Traversal in asset.upload MCP via Prompt Injection
CVE-2026-82233
6.9 - Medium
- August 28, 2026
SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.
Directory traversal
SiYuan <v3.7.4: bazaar install allows overwrite via mismatched packageName
CVE-2026-62204
5.9 - Medium
- August 22, 2026
SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.
Insufficient Verification of Data Authenticity
SiYuan <3.7.4: API Search/removeTemplate Allows Arbitrary File Delete
CVE-2026-60084
8.4 - High
- August 22, 2026
SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.
Directory traversal
SiYuan < v3.8.0 Path Blocklist Flaw Exposes Sensitive Files
CVE-2026-60083
6.9 - Medium
- August 22, 2026
SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.
AuthZ
Secret exfil via interpolated URL in SiYuan MCP <v3.8.0
CVE-2026-59809
6.9 - Medium
- August 22, 2026
SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values to any public host without confirmation.
Insertion of Sensitive Information Into Sent Data
SiYuan <3.7.4 PathTraverse via Bazaar Install/Uninstall (admin)
CVE-2026-77086
9.4 - Critical
- August 21, 2026
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.
Directory traversal
SiYuan <3.7.4 XSS: Unsafe Path-Tree Tooltip Enables RCE
CVE-2026-75917
9.3 - Critical
- August 19, 2026
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by the 'move/link to' path-selection dialogs, where document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated into the aria-label HTML attribute without escaping. A document crafted with a double quote in any of these fields breaks out of the attribute context and injects arbitrary HTML attributes including inline event handlers (e.g., onmouseover). Because every SiYuan Electron BrowserWindow runs with nodeIntegration:true, contextIsolation:false, and no CSP, the injected handler gains require('child_process') access, escalating the XSS to arbitrary OS command execution when a victim merely hovers over the malicious document entry in the path-picker dialog. Malicious documents reach victims via sharing, sync, or import.
XSS
SiYuan <=3.7.3 Block-Reference XSS OS Command Exec via Electron
CVE-2026-75916
9.3 - Critical
- August 19, 2026
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. <img src=x onerror=...>) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('child_process') access, allowing the XSS to escalate to arbitrary OS command execution.
XSS
SiYuan <=3.7.3: Incorrect auth in publish-mode endpoints (CVE-2026-74906)
CVE-2026-74906
8.7 - High
- August 18, 2026
SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.
AuthZ
SiYuan <3.7.4 SSRF via isPrivateIP in SafeMode
CVE-2026-74905
6.9 - Medium
- August 18, 2026
SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure.
SSRF
SiYuan <3.7.4 Block Metadata Disclosure via Missing Auth (CVE-2026-74904)
CVE-2026-74904
8.7 - High
- August 18, 2026
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.
AuthZ
SiYuan <3.7.4: Inadequate Access Control in /api/lute/spinBlockDOM
CVE-2026-74903
5.3 - Medium
- August 18, 2026
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.
Resource Exhaustion
SiYuan <3.7.4 XSS: insertAdjacentHTML Vulnerability in File Upload
CVE-2026-74902
9.3 - Critical
- August 18, 2026
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.
XSS
SiYuan <3.7.4 Unthrottled Brute-Force via Publish Service Basic Auth
CVE-2026-74868
8.7 - High
- August 17, 2026
SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rate limiting, per-account lockout, or backoff. Unauthenticated remote attackers can submit unlimited password guesses against named accounts to gain access to published notes/notebooks.
Improper Restriction of Excessive Authentication Attempts
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for B3log Siyuan or by B3log? Click the Watch button to subscribe.
