Threats Tagged 'ghsa-3cc2-h3v6-rqpq'

CVE-2026-74802 is a high-severity vulnerability in the siyuan-note software (version 3.7.3 and earlier) involving an origin validation bypass in an admin-only WebSocket proxy endpoint. The endpoint disables origin checks by overriding the gorilla/websocket library's default origin validation, allowing cross-site WebSocket hijacking. This enables an attacker to leverage a victim's active admin session to proxy arbitrary network traffic through the victim's machine, potentially accessing internal or localhost-only services. No patch is currently available for this issue.