Threat Intelligence Database

SiYuan Note versions from 3.1.12 up to but not including 3.8.6 contain a vulnerability in the Sprig template function map used in the /api/icon/getDynamicIcon endpoint. This flaw allows a publish reader or any user when publish authentication is disabled to invoke uncapped functions such as 'until', leading to resource exhaustion and potentially causing the kernel to be OOM-killed with a single request.

SiYuan versions from 3.7.0 up to but not including 3.8.6 contain an absolute path traversal vulnerability in the kernel's private plugin HTTP server. This flaw allows attackers who can supply a malicious kernel plugin to read arbitrary files accessible by the SiYuan process, including sensitive files such as the API token and configuration files. The vulnerability arises because the server passes a file path to the HTTP context without validating it properly.

SiYuan versions before 3.8.5 have an information disclosure vulnerability that allows unauthorized users to obtain backlink block IDs and reference counts from password-protected and publish-disabled documents by querying published documents. This bypasses the intended confidentiality of unpublished content.

CVE-2026-74802 is a high-severity vulnerability in the siyuan-note software (version 3.7.3 and earlier) involving an origin validation bypass in an admin-only WebSocket proxy endpoint. The endpoint disables origin checks by overriding the gorilla/websocket library's default origin validation, allowing cross-site WebSocket hijacking. This enables an attacker to leverage a victim's active admin session to proxy arbitrary network traffic through the victim's machine, potentially accessing internal or localhost-only services. No patch is currently available for this issue.

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.

SiYuan versions prior to 3.8.5 have a missing authorization vulnerability in certain API endpoints that allows read-only or anonymous publish visitors to discover unpublished notebook box IDs. By sending a POST request with any open notebook ID, attackers can obtain the global save-box ID and save-path template, revealing the existence and creation time of hidden notebooks. This vulnerability has a medium severity rating with a CVSS score of 6.9.

CVE-2026-101092 is a medium severity vulnerability in SiYuan note-taking software versions before 3.8.4. The issue involves a failure to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing unauthorized users with publish reader access to retrieve image asset paths from databases they should not access. This can lead to exposure of sensitive image asset paths and filenames that the rendering endpoint would normally block.

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-initiated cross-site request carries an Origin. Because browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads — and the session cookie is SameSite=Lax — a single cross-site GET issued from any attacker-controlled web page is granted RoleAdministrator, both on default installations with no access-authorization code and on password-protected instances with a live session. Combined with content-type sniffing on the /api/network/proxy endpoint, which allows attacker-controlled HTML to be served under SiYuan's own origin, this permits an unauthenticated remote attacker to execute arbitrary script in the SiYuan origin (http://127.0.0.1:6806), invoke administrator APIs, and exfiltrate the persistent kernel API token. This issue is fixed in version 3.8.4.