SiYuan note-taking software versions before 3.8.0 have an authorization flaw in the MCP file tool. This flaw results from an incomplete path blocklist that does not properly restrict access to sensitive workspace files via the HTTP API. Authenticated administrators can exploit this to read plaintext publish-mode passwords and access other sensitive configuration files.
SiYuan note-taking software versions prior to 3.8.0 contain a vulnerability where secret placeholders are interpolated into the destination URL parameter of the http_request MCP tool. This allows an attacker controlling an MCP client to craft requests that exfiltrate plaintext secret values to arbitrary external hosts without user confirmation.
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.
SiYuan versions before 3.7.4 contain a critical cross-site scripting (XSS) vulnerability in the file-tree picker's hover-tooltip generation. This flaw arises from improper escaping of document metadata fields concatenated into an aria-label attribute, allowing injection of arbitrary HTML attributes and inline event handlers. Due to the Electron BrowserWindow configuration (nodeIntegration:true, contextIsolation:false, no CSP), this XSS can escalate to arbitrary OS command execution when a user hovers over a malicious document entry. The vulnerability affects local installations and can be triggered via shared, synced, or imported malicious documents.
SiYuan note-taking application versions up to 3.7.3 contain a critical cross-site scripting (XSS) vulnerability in the block-reference autocomplete hint popup. The vulnerability arises because user-controllable metadata fields are concatenated into HTML without proper escaping, allowing injection of malicious scripts. Due to SiYuan's Electron environment configuration (nodeIntegration enabled, contextIsolation disabled, no CSP), this XSS can escalate to arbitrary OS command execution.
CVE-2026-74904 is a missing authorization vulnerability in the siyuan-note software affecting multiple API endpoints under /api/block/*. Seventeen handlers in kernel/api/block.go return block content-derived text, structural metadata, or existence information for any block ID without proper access checks or admin role requirements. This allows anonymous users to retrieve sensitive workspace content and metadata without authentication. The vulnerability affects siyuan versions from 0 up to but not including 3.7.4. The CVSS 4.0 score is 8.7 (high severity).
SiYuan note-taking software versions before 3.7.4 have an incorrect authorization vulnerability affecting eight publish-mode reader-facing endpoints. These endpoints incorrectly filter content using a visibility list instead of a disabled list, allowing anonymous users to access documents explicitly marked as forbidden from publishing. This vulnerability enables unauthorized discovery and reading of restricted content via search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.
SiYuan note-taking software versions before 3.7.4 contain a server-side request forgery (SSRF) vulnerability in the isPrivateIP function. This function fails to recognize certain IPv6 transition addresses that embed private IPv4 destinations, allowing authenticated attackers to bypass SSRF protections in SafeMode. Exploitation can occur via network forward proxy, WebSocket proxy, or SSE proxy endpoints, enabling attackers to access internal services and cloud metadata endpoints such as 169.254.169.254. The vulnerability allows full-read SSRF, potentially leading to credential theft and internal network reconnaissance.
CVE-2026-74903 is a medium severity vulnerability in SiYuan note-taking software versions before 3.7.4. It involves insufficient access control on the /api/lute/spinBlockDOM endpoint, which is protected only by CheckAuth middleware rather than the stricter CheckAdminRole. This allows authenticated users with RoleEditor or RoleReader roles to invoke the endpoint with arbitrary DOM input. Large payloads can cause resource exhaustion due to per-path mutex serialization, leading to endpoint starvation.
SiYuan note-taking software versions before 3.7.4 contain a critical cross-site scripting (XSS) vulnerability in the file upload validation process. The vulnerability arises because filenames are not properly escaped before being inserted into HTML using insertAdjacentHTML. This allows attackers to craft malicious filenames with embedded script payloads that execute with full OS command access when a user interacts with the file in the editor via drag, drop, or paste actions.
CVE-2026-74802 is a high-severity vulnerability in the siyuan-note software (version 3.7.3 and earlier) involving an origin validation bypass in an admin-only WebSocket proxy endpoint. The endpoint disables origin checks by overriding the gorilla/websocket library's default origin validation, allowing cross-site WebSocket hijacking. This enables an attacker to leverage a victim's active admin session to proxy arbitrary network traffic through the victim's machine, potentially accessing internal or localhost-only services. No patch is currently available for this issue.
SiYuan versions before 3.7.4 have a vulnerability in the Publish Service Basic Auth implementation that allows unauthenticated remote attackers to perform unlimited password guesses due to lack of rate limiting or account lockout. This can lead to unauthorized access to published notes and notebooks.
SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf of authenticated users by submitting requests with valid session cookies, relying on browser default SameSite policies rather than server-enforced protections.
SiYuan before version 3.7.4 contains an OS command injection vulnerability due to improper escaping of workspace directory paths when constructing command-line arguments for an elevated helper process. This flaw allows attackers to craft malicious workspace directory names with command metacharacters that can execute arbitrary commands with administrator privileges after user approval via UAC.
CVE-2026-74800 is a critical stored cross-site scripting (XSS) vulnerability in SiYuan note-taking software versions prior to 3.7.4. The issue arises because the software fails to set the Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets. Authenticated attackers can exploit this by uploading malicious HTML files as assets, which execute scripts with full kernel API access when the workspace owner opens the asset link.
SiYuan versions before 3.7.4 expose Go net/http/pprof debug endpoints without authentication when not running in exactly 'prod' mode. This allows attackers to access sensitive in-memory information such as AccessAuthCode and AI provider API keys via endpoints like /debug/pprof/heap. The vulnerability has a critical CVSS 4.0 score of 9.2.
SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepath.Join without validating that id matches SiYuan's node-ID format. An authenticated MCP client can supply path traversal sequences in id to cause the kernel to copy an arbitrary file readable by the process into SiYuan's history directory (arbitrary file read) and then delete the original file (arbitrary file deletion). The corresponding HTTP API handler was hardened in GHSA-7hm9-v7vf-7g4w, but this MCP caller was not.
SiYuan Note versions prior to 3.7.4 have a vulnerability in the CheckAuth() middleware that allows unlimited automated guesses of the API token via the Authorization header or token query parameter. This bypasses CAPTCHA and lockout protections, enabling unauthenticated attackers to gain full administrator access. The vulnerability is critical with a CVSS score of 9.3.
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.
SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.