SiYuan versions 3.8.7 through 3.8.8 have a vulnerability where Windows GLOBALROOT device-namespace aliases are not normalized, allowing attackers to bypass the IsSensitivePath denylist. This flaw enables attackers with appropriate privileges to invoke importStdMd with a specially crafted GLOBALROOT-prefixed path, resulting in unauthorized copying of sensitive files such as the API token and TLS private key into a publicly accessible directory.
SiYuan versions 3.5.4 up to but not including 3.8.7 on Windows have a path traversal vulnerability due to improper handling of Windows extended-length path prefixes. Authenticated API users can exploit this to bypass a sensitive-path denylist and copy sensitive workspace configuration files, including API tokens and TLS private keys, into publicly accessible assets. This issue is fixed in version 3.8.7.
SiYuan note-taking software versions prior to 3.8.7 contain an SQL injection vulnerability that allows users with admin-token privileges to inject malicious SQL commands via unescaped query parameters. This flaw enables attackers to exfiltrate sensitive information such as deleted document content, titles, and paths from the history database.
SiYuan note-taking software versions from 2.10.0 up to but not including 3.8.7 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with edit permissions to inject malicious JavaScript code via specially crafted math block content when KaTeX trust is enabled. The vulnerability arises because certain math rendering functions assign user-controlled content using innerHTML, enabling script execution when a reader clicks on the rendered link. The issue is fixed in version 3.8.7.
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.
SiYuan note-taking software versions from 2.9.0 up to but not including 3.8.7 contain a cross-site scripting (XSS) vulnerability in the unauthenticated /check-auth page. This flaw allows attackers to craft a link with a javascript: URI that is assigned to window.location.href without proper scheme validation. After a victim logs in, the malicious script executes, potentially invoking kernel APIs to read or modify workspace content and settings. The vulnerability is fixed in version 3.8.7.
SiYuan versions 3.6.0 through 3.8.6 have a vulnerability where the networkServeTLS setting is accepted but not enforced. This causes the kernel port to serve full API access over unencrypted HTTP alongside HTTPS. As a result, network-adjacent attackers can intercept cleartext login credentials and session cookies, which lack the Secure attribute and are not protected by HSTS, enabling session hijacking.
SiYuan Note versions from 3.1.12 up to but not including 3.8.6 contain a vulnerability in the Sprig template function map used in the /api/icon/getDynamicIcon endpoint. This flaw allows a publish reader or any user when publish authentication is disabled to invoke uncapped functions such as 'until', leading to resource exhaustion and potentially causing the kernel to be OOM-killed with a single request.
SiYuan versions from 3.7.0 up to but not including 3.8.6 contain an absolute path traversal vulnerability in the kernel's private plugin HTTP server. This flaw allows attackers who can supply a malicious kernel plugin to read arbitrary files accessible by the SiYuan process, including sensitive files such as the API token and configuration files. The vulnerability arises because the server passes a file path to the HTTP context without validating it properly.
SiYuan versions before 3.8.5 have an information disclosure vulnerability that allows unauthorized users to obtain backlink block IDs and reference counts from password-protected and publish-disabled documents by querying published documents. This bypasses the intended confidentiality of unpublished content.
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.
SiYuan versions prior to 3.8.5 have a missing authorization vulnerability in certain API endpoints that allows read-only or anonymous publish visitors to discover unpublished notebook box IDs. By sending a POST request with any open notebook ID, attackers can obtain the global save-box ID and save-path template, revealing the existence and creation time of hidden notebooks. This vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-101092 is a medium severity vulnerability in SiYuan note-taking software versions before 3.8.4. The issue involves a failure to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing unauthorized users with publish reader access to retrieve image asset paths from databases they should not access. This can lead to exposure of sensitive image asset paths and filenames that the rendering endpoint would normally block.
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.
SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-initiated cross-site request carries an Origin. Because browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads — and the session cookie is SameSite=Lax — a single cross-site GET issued from any attacker-controlled web page is granted RoleAdministrator, both on default installations with no access-authorization code and on password-protected instances with a live session. Combined with content-type sniffing on the /api/network/proxy endpoint, which allows attacker-controlled HTML to be served under SiYuan's own origin, this permits an unauthenticated remote attacker to execute arbitrary script in the SiYuan origin (http://127.0.0.1:6806), invoke administrator APIs, and exfiltrate the persistent kernel API token. This issue is fixed in version 3.8.4.
SiYuan note-taking application versions 3.7.0 up to but not including 3.8.4 contain a stored cross-site scripting (XSS) vulnerability. This flaw occurs in the gallery and kanban database renderers where field descriptions are not properly escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, this allows attackers to inject JavaScript that can execute arbitrary commands with user privileges via Node.js child_process APIs. The vulnerability has a high severity score of 8.6.
SiYuan note-taking software versions before 3.8.4 contain a high-severity SQL injection vulnerability in the graph query endpoint. The vulnerability arises because the dailyNoteSavePath parameter is concatenated into an SQL query without proper escaping. This allows unauthenticated attackers on published sites with authentication disabled to perform SQL injection via UNION SELECT, potentially extracting arbitrary database rows from all notebooks.
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.
SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.