Threats affecting pkg:npm/siyuan

SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.

SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.

SiYuan before version 3.7.3 contains a vulnerability where publish-access filters are not applied to certain content endpoints, allowing unauthorized readers to access rendered DOM content of documents that should be restricted. This affects the getBacklinkDoc and getBackmentionDoc API endpoints, enabling a publish-mode reader, including anonymous users if Basic Auth is disabled, to retrieve content from publish-forbidden documents.