The SiYuan kernel's AI Agent tools (http_request and web_fetch) implement SSRF protection via the CheckHostSSRF function, which performs a single DNS resolution to block private, loopback, and link-local IPs at guard time. However, the actual network connection performs a second DNS resolution without enforcing the same IP restrictions, allowing a DNS rebinding TOCTOU attack. An attacker-controlled domain can respond with a public IP during the guard check and a private or loopback IP during connection, bypassing SSRF defenses and accessing internal resources. This incomplete fix variant relates to a prior advisory (GHSA-rg26-cg95-gq6p) where connect-time checks were not applied to the agent tool paths. The vulnerability was confirmed on version 3.8.0 and fixed in 3.8.1.

An attacker who can control the domain name requested by the AI Agent tools can exploit this vulnerability to bypass SSRF protections and access internal or cloud metadata services that should be blocked. This could lead to unauthorized disclosure of sensitive internal information. The exploitation probability is considered low to moderate, requiring attacker influence over the AI Agent's URL input (e.g., via prompt injection). The vulnerability is exploitable in default configurations with SafeMode both enabled and disabled.

A patch is available in SiYuan version 3.8.1 that fixes this vulnerability by properly enforcing connect-time IP checks. Users should upgrade to version 3.8.1 or later. No additional mitigations are required if the patch is applied. Until patched, restricting access to the AI Agent tools or limiting attacker control over URLs may reduce risk but is not a complete mitigation.