CVE-2026-32940 is a critical cross-site scripting (XSS) vulnerability in SiYuan personal knowledge management system versions 3.6.0 and below. The vulnerability arises from incomplete sanitization of SVG content in the unauthenticated /api/icon/getDynamicIcon endpoint, which improperly allows JavaScript execution via crafted SVGs using bypassed MIME types (data:text/xml and data:application/xml). An attacker can craft a URL that, when visited or embedded via <object> or <embed>, triggers JavaScript execution through injected interactive links inside SVG images. The vulnerability does not affect <img> tag rendering due to lack of interactivity. Exploitation requires user interaction (clicking the injected link) but no authentication. This issue has been fixed in version 3.6.1.
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Together with GET /assets/*path, which only requires authentication, a publish-service visitor can cause the desktop kernel to copy any readable sensitive file and then read it via GET, leading to exfiltration of sensitive files. This issue has been fixed in version 3.6.1.
SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlying SQLite database without any authorization or read-only checks. This allows any authenticated user — including those with the Reader role — to execute arbitrary SQL statements (SELECT, DELETE, UPDATE, DROP TABLE, etc.) against the application's database. This is inconsistent with the application's own security model: the dedicated SQL endpoint (/api/query/sql) correctly requires both CheckAdminRole and CheckReadonly middleware, but the search endpoint bypasses these controls entirely. This issue has been fixed in version 3.6.1.
CVE-2026-32815 is an improper authentication vulnerability in SiYuan Note versions 3.6.0 and below. The WebSocket endpoint (/ws) allows unauthenticated connections when specific URL parameters are used, enabling external clients, including malicious websites, to connect and receive real-time server push events. This leaks sensitive metadata such as document titles, notebook names, file paths, and CRUD operations performed by authenticated users. The lack of Origin header validation allows cross-origin WebSocket connections, enabling silent monitoring of a victim's local SiYuan instance. The vulnerability has been fixed in version 3.6.1. The CVSS 4.
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation. The function recursively reads every file under the given path and permanently stores their content as SiYuan note documents in the workspace database, making them searchable and accessible to all workspace users. Data persists in the workspace database across restarts and is accessible to Publish Service Reader accounts. Combined with the renderSprig SQL injection ( separate advisory ), a non-admin user can then read all imported secrets without any additional privileges. This issue has been fixed in version 3.6.1.
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version (Files.ts) properly uses escapeHtml() for the same operation. An authenticated user who can rename notebooks can inject arbitrary HTML/JavaScript that executes on any mobile client viewing the file tree. Since Electron is configured with nodeIntegration: true and contextIsolation: false, the injected JavaScript has full Node.js access, escalating stored XSS to full remote code execution. The mobile layout is also used in the Electron desktop app when the window is narrow, making this exploitable on desktop as well. This issue has been fixed in version 3.6.1.
CVE-2026-32749 is a high-severity vulnerability in SiYuan personal knowledge management system versions 3.6.0 and below. It involves improper sanitization of file paths in two API endpoints that handle uploaded archives, allowing an admin user to write files to arbitrary locations outside the intended temporary directory. This flaw can lead to remote code execution (RCE) by overwriting critical system or application files. In Docker containers running as root, exploitation results in full container compromise. The vulnerability does not require user interaction but does require admin privileges. It has been fixed in version 3.6.1.
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the globalCopyFiles API eads source files using filepath.Abs() with no workspace boundary check, relying solely on util.IsSensitivePath() whose blocklist omits /proc/, /run/secrets/, and home directory dotfiles. An admin can copy /proc/1/environ or Docker secrets into the workspace and read them via the standard file API. An admin can exfiltrate any file readable by the SiYuan process that falls outside the incomplete blocklist. In containerized deployments this includes all injected secrets and environment variables - a common pattern for passing credentials to containers. The exfiltrated files are then accessible via the standard workspace file API and persist until manually deleted. This issue has been fixed in version 3.6.1.
SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. This vulnerability is fixed in 3.6.1.
CVE-2026-32110 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the siyuan-note personal knowledge management system versions prior to 3.6.0. Authenticated users can exploit the /api/network/forwardProxy endpoint to make arbitrary HTTP requests from the server without URL validation, allowing access to internal networks, localhost, or cloud metadata services. This can lead to disclosure of sensitive internal information, compromise of confidentiality and integrity, and limited availability impact. The vulnerability requires authentication but no user interaction beyond that. It is fixed in version 3.6.0. Organizations using affected versions should upgrade immediately and restrict access to the vulnerable endpoint.
SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) checks href attributes for the javascript: prefix using strings.HasPrefix(). However, inserting ASCII tab (	), newline ( ), or carriage return ( ) characters inside the javascript: string bypasses this prefix check. Browsers strip these characters per the WHATWG URL specification before parsing the URL scheme, so the JavaScript still executes. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint, creating a reflected XSS. This is a second bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in 3.5.10.
SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements (<animate>, <set>) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in v3.5.10.
SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.
SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes.
SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.
SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in version 3.6.0.
SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.
Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the Markdown rendering engine. An attacker can inject malicious JavaScript into a Markdown text/note. When another user clicks the rendered content, the script executes in the context of their session.
CVE-2026-25539 is a critical path traversal vulnerability in the SiYuan personal knowledge management system versions prior to 3.5.5. The flaw exists in the /api/file/copyFile endpoint, where the dest parameter is not properly validated, allowing authenticated users to write files to arbitrary filesystem locations. Exploitation can lead to remote code execution by overwriting sensitive files such as cron jobs, SSH authorized_keys, or shell configuration files. The vulnerability requires authentication but no user interaction and has a CVSS score of 9.1, reflecting its high impact on confidentiality, integrity, and availability. Although no known exploits are reported in the wild, the issue is severe and has been patched in version 3.5.5.
CVE-2026-23852 is a medium severity stored Cross-Site Scripting (XSS) vulnerability in SiYuan Note versions prior to 3.5.4. It allows attackers to inject arbitrary HTML attributes into the 'icon' attribute of a block via the /api/attr/setBlockAttrs API. The injected payload is rendered unsanitized in the dynamic icon feature, leading to stored XSS and, in the desktop environment, potential remote code execution (RCE). This vulnerability bypasses a previous fix and affects personal knowledge management systems using vulnerable SiYuan versions. No known exploits are currently reported in the wild. The vulnerability has a CVSS 4.0 score of 5.8, indicating medium severity.
