[ Vendor · 30 CVEs ]
siyuan-note
CVEs affecting siyuan-note published in the last 30 days, plus any siyuan-note CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109309 | 12 Oct 2026 | CVSS 6.5 | siyuan-note siyuanSiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel… | |
| CVE-2026-109310 | 12 Oct 2026 | CVSS 6.5 | siyuan-note siyuanSiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource… | |
| CVE-2026-105205 | 4 Oct 2026 | CVSS 5.3 | siyuan-note siyuanSiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference… | |
| CVE-2026-103763 | 2 Oct 2026 | CVSS 5.8 | siyuan-note siyuanSiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded… | |
| CVE-2026-104410 | 2 Oct 2026 | CVSS 7.5 | siyuan-note siyuanSiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled… | |
| CVE-2026-103762 | 2 Oct 2026 | CVSS 5.3 | siyuan-note siyuanSiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath… | |
| CVE-2026-101091 | 28 Sep 2026 | CVSS 7.1 | siyuan-note siyuanSiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft… | |
| CVE-2026-101092 | 28 Sep 2026 | CVSS 5.3 | siyuan-note siyuanSiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image… | |
| CVE-2026-100641 | 26 Sep 2026 | CVSS 8.0 | siyuan-note siyuanSiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content… | |
| CVE-2026-100642 | 26 Sep 2026 | CVSS 7.6 | siyuan-note siyuanSiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that… | |
| CVE-2026-100643 | 26 Sep 2026 | CVSS 8.0 | siyuan-note siyuanSiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to… | |
| CVE-2026-100644 | 26 Sep 2026 | CVSS 7.5 | siyuan-note siyuanSiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into… | |
| CVE-2026-100645 | 26 Sep 2026 | CVSS 8.0 | siyuan-note siyuanSiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field… | |
| CVE-2026-100646 | 26 Sep 2026 | CVSS 8.1 | siyuan-note siyuanSiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in… | |
| CVE-2026-100635 | 26 Sep 2026 | CVSS 5.9 | siyuan-note siyuanSiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or… | |
| CVE-2026-100636 | 26 Sep 2026 | CVSS 7.6 | siyuan-note siyuanSiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to… | |
| CVE-2026-100637 | 26 Sep 2026 | CVSS 7.6 | siyuan-note siyuanSiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write… | |
| CVE-2026-100638 | 26 Sep 2026 | CVSS 7.6 | siyuan-note siyuanSiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to… | |
| CVE-2026-100639 | 26 Sep 2026 | CVSS 8.8 | siyuan-note siyuanSiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via… | |
| CVE-2026-100640 | 26 Sep 2026 | CVSS 4.7 | siyuan-note siyuanSiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard… | |
| CVE-2026-100633 | 26 Sep 2026 | CVSS 6.5 | siyuan-note siyuanSiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard… | |
| CVE-2026-100634 | 26 Sep 2026 | CVSS 4.7 | siyuan-note siyuanSiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process… | |
| CVE-2026-74904 | 18 Aug 2026 | CVSS 7.5 | SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readersSiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText… | Fix |
| CVE-2026-74802 | 17 Aug 2026 | CVSS 8.2 | SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypassSiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly… | Fix |
| CVE-2026-73609 | 13 Aug 2026 | CVSS 5.8 | SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filteringSiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in… | Fix |
| CVE-2026-73607 | 13 Aug 2026 | CVSS 5.8 | SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access checkSiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no… | Fix |
| CVE-2026-73606 | 13 Aug 2026 | CVSS 5.8 | SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given blockSiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check… | Fix |
| CVE-2026-73605 | 13 Aug 2026 | CVSS 5.8 | SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystemSiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe… | Fix |
| CVE-2026-72788 | 12 Aug 2026 | CVSS 5.8 | SiYuan discloses an administrator's open documents and search terms to anonymous readersSiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator… | Fix |
| CVE-2026-69085 | 3 Aug 2026 | CVSS 10.0 | SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stackingSiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is… | Fix |