SiYuan Note versions from 3.1.12 up to but not including 3.8.6 contain a vulnerability in the Sprig template function map used in the /api/icon/getDynamicIcon endpoint. This flaw allows a publish reader or any user when publish authentication is disabled to invoke uncapped functions such as 'until', leading to resource exhaustion and potentially causing the kernel to be OOM-killed with a single request.
SiYuan versions from 3.7.0 up to but not including 3.8.6 contain an absolute path traversal vulnerability in the kernel's private plugin HTTP server. This flaw allows attackers who can supply a malicious kernel plugin to read arbitrary files accessible by the SiYuan process, including sensitive files such as the API token and configuration files. The vulnerability arises because the server passes a file path to the HTTP context without validating it properly.
SiYuan versions before 3.8.5 have an information disclosure vulnerability that allows unauthorized users to obtain backlink block IDs and reference counts from password-protected and publish-disabled documents by querying published documents. This bypasses the intended confidentiality of unpublished content.
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.
SiYuan versions prior to 3.8.5 have a missing authorization vulnerability in certain API endpoints that allows read-only or anonymous publish visitors to discover unpublished notebook box IDs. By sending a POST request with any open notebook ID, attackers can obtain the global save-box ID and save-path template, revealing the existence and creation time of hidden notebooks. This vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-101092 is a medium severity vulnerability in SiYuan note-taking software versions before 3.8.4. The issue involves a failure to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing unauthorized users with publish reader access to retrieve image asset paths from databases they should not access. This can lead to exposure of sensitive image asset paths and filenames that the rendering endpoint would normally block.
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.
SiYuan note-taking application versions 3.7.0 up to but not including 3.8.4 contain a stored cross-site scripting (XSS) vulnerability. This flaw occurs in the gallery and kanban database renderers where field descriptions are not properly escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, this allows attackers to inject JavaScript that can execute arbitrary commands with user privileges via Node.js child_process APIs. The vulnerability has a high severity score of 8.6.
SiYuan note-taking software versions before 3.8.4 contain a high-severity SQL injection vulnerability in the graph query endpoint. The vulnerability arises because the dailyNoteSavePath parameter is concatenated into an SQL query without proper escaping. This allows unauthenticated attackers on published sites with authentication disabled to perform SQL injection via UNION SELECT, potentially extracting arbitrary database rows from all notebooks.
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.
SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.
SiYuan note-taking software versions before 3.8.4 contain a cross-site scripting (XSS) vulnerability due to improper HTML escaping of flashcard block content. This flaw allows attacker-supplied content to execute scripts in a privileged renderer context when an administrator views the card manager. The vulnerability requires authentication and administrator privileges to exploit and can lead to arbitrary code execution on the host system.
SiYuan versions before 3.8.4 have an authorization omission vulnerability in the siyuan-get IPC handler. This flaw allows remote renderer processes to access native clipboard data formats such as MathML, Office, and WPS content during user-mediated paste operations. Attackers controlling remote renderer content can exploit this to read sensitive clipboard data without proper authorization.
SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4.
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook parameter to escape the workspace data directory and write conf.json files to arbitrary locations accessible by the kernel process.
SiYuan versions before 3.8.4 have a path traversal vulnerability in the checkoutRepo endpoint. Authenticated administrators can exploit this flaw by supplying a crafted sessionID parameter to write JSON files outside the intended workspace directory. This allows overwriting arbitrary JSON files in kernel-writable directories beyond workspace boundaries.
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.
SiYuan versions before 3.8.4 have an authentication bypass vulnerability in the publish service. This occurs because session cookies are issued without Secure or SameSite attributes over plaintext HTTP, allowing an attacker on the network path to capture and replay a valid session cookie. This enables unauthorized access to authenticated publish endpoints without needing the account password.
SiYuan note-taking software versions before 3.8.4 contain a missing authorization vulnerability in the 'siyuan-send-windows' IPC handler within the Electron main process. This flaw allows a renderer connected to a remote kernel to send commands that cause windows from other workspaces to lock repeatedly, resulting in a limited denial of service. There is no observed impact on confidentiality, integrity, or code execution.