SiYuan versions 3.8.7 through 3.8.8 contain a path traversal vulnerability due to improper normalization of Windows GLOBALROOT device-namespace aliases. This flaw allows attackers with high privileges to bypass path restrictions and copy sensitive files such as API tokens and TLS private keys into publicly accessible directories.
SiYuan versions 3.5.4 up to but not including 3.8.7 on Windows have a path traversal vulnerability due to improper handling of Windows extended-length path prefixes. Authenticated API users can exploit this to bypass a sensitive-path denylist and copy sensitive workspace configuration files, including API tokens and TLS private keys, into publicly accessible assets. This issue is fixed in version 3.8.7.
SiYuan note-taking software versions prior to 3.8.7 contain an SQL injection vulnerability that allows users with admin-token privileges to inject malicious SQL commands via unescaped query parameters. This flaw enables attackers to exfiltrate sensitive information such as deleted document content, titles, and paths from the history database.
SiYuan note-taking software versions from 2.10.0 up to but not including 3.8.7 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with edit permissions to inject malicious JavaScript code via specially crafted math block content when KaTeX trust is enabled. The vulnerability arises because certain math rendering functions assign user-controlled content using innerHTML, enabling script execution when a reader clicks on the rendered link. The issue is fixed in version 3.8.7.
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.
SiYuan versions up to 3.8.3 have an origin validation flaw where the absence of the HTTP Origin header causes authentication checks to fail open. This allows cross-site GET requests from attacker-controlled pages to gain administrator privileges. The vulnerability also enables remote script execution within the SiYuan origin and exfiltration of the kernel API token. The issue is fixed in version 3.8.4.
SiYuan note-taking software versions before 3.8.4 have an authorization omission vulnerability in the siyuan-get IPC handler. This flaw allows remote kernel renderers to access native clipboard data formats such as MathML, Office, and WPS bytes by invoking specific clipboard read commands. Attackers controlling remote renderer content can exploit this to obtain sensitive clipboard contents during user-mediated paste operations. The vulnerability is fixed in version 3.8.4.
SiYuan versions prior to 3.8.4 have an authentication bypass vulnerability in the publish service. Session cookies are transmitted without Secure or SameSite attributes over plaintext HTTP, allowing an attacker on the network path to capture and replay a valid session cookie to access authenticated publish endpoints without the account password. This issue is fixed in version 3.8.4.
SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4-alpha.2.
CVE-2026-56397 is a critical cross-site scripting (XSS) vulnerability in SiYuan versions before 3.6.1. It arises from improper sanitization of package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Exploitation can lead to remote code execution on any user browsing the Bazaar by leveraging Electron's nodeIntegration setting to execute OS commands.