Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
89 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The SiYuan kernel WebSocket server accepts unauthenticated connections when a specific “auth keepalive” query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on attacker-controlled JSON. A remote attacker can send malformed messages that trigger a runtime panic, potentially crashing the kernel process and causing denial of service. Details 1. Authentication Bypass via Keepalive Query Unauthenticated connections are accepted if the request URI matches a specific pattern intended for an authentication page keepalive. File: kernel/server/serve.go 2. Unsafe Type Assertions on Untrusted Input Incoming JSON messages are parsed into a generic map and fields are accessed without validation. File: kernel/server/serve.go Malformed or missing fields trigger a runtime panic. The handler does not implement local panic recovery, allowing crashes to propagate. PoC Step 1 — Prepare workspace directory Step 2 — Run SiYuan container Service…
Recommended action: Upgrade to 3.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The IsSensitivePath() function in kernel/util/path.go uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including /opt (application data), /usr (local configs/binaries), /home (other users), /mnt and /media (mounted volumes). The globalCopyFiles and importStdMd endpoints rely on IsSensitivePath as their primary defense against reading files outside the workspace. Details Current denylist in kernel/util/path.go:391-405: NOT blocked: - /opt — commonly contains application data, databases, credentials. In SiYuan Docker, /opt/siyuan/ contains the application itself. - /usr — contains /usr/local/etc, /usr/local/share, custom configs - /home — other users' home directories (only ~/.ssh and ~/.config of the current HomeDir are blocked via separate checks, but other users' homes are accessible) - /mnt, /media — mounted volumes, network shares, often containing…
Recommended action: Upgrade to 3.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260317012524-fe4523fff2c8
Fixed in
0.0.0-20260317012524-fe4523fff2c8· Vendor fix available
Issue
Stored XSS to RCE via Unsanitized Bazaar Package Metadata Summary SiYuan's Bazaar (community marketplace) renders package metadata fields (displayName, description) using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fields, which executes automatically when any user browses the Bazaar page. Because SiYuan's Electron configuration enables nodeIntegration: true with contextIsolation: false, this XSS escalates directly to full Remote Code Execution on the victim's operating system — with zero user interaction beyond opening the marketplace tab. Affected Component - Metadata rendering: app/src/config/bazaar.ts:275-277 - Electron config: app/electron/main.js:422-426 (nodeIntegration: true, contextIsolation: false) Affected Versions - SiYuan <= 3.5.9 Severity Critical — CVSS 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CWE-79: Improper Neutralization of Input During Web Page Generation (Stored XSS) Vulnerable Code In…
Recommended action: Upgrade to 0.0.0-20260317012524-fe4523fff2c8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260314111550-b382f50e1880
Fixed in
0.0.0-20260314111550-b382f50e1880· Vendor fix available
Issue
Stored XSS to RCE via Unsanitized Bazaar README Rendering Summary SiYuan's Bazaar (community marketplace) renders package README content without HTML sanitization. The backend renderREADME function uses lute.New() without calling SetSanitize(true), allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to innerHTML without any additional sanitization. A malicious package author can embed arbitrary JavaScript in their README that executes when a user clicks to view the package details. Because SiYuan's Electron configuration enables nodeIntegration: true with contextIsolation: false, this XSS escalates directly to full Remote Code Execution. Affected Component - README rendering (backend): kernel/bazaar/package.go:635-645 (renderREADME function) - README rendering (frontend): app/src/config/bazaar.ts:607 (innerHTML assignment) - Electron config: app/electron/main.js:422-426 (nodeIntegration: true, contextIsolation: false)…
Recommended action: Upgrade to 0.0.0-20260314111550-b382f50e1880 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. Details File: kernel/api/router.go Every sensitive endpoint in the codebase uses model.CheckAuth + model.CheckAdminRole, but renderSprig only has CheckAuth: renderSprig calls model.RenderGoTemplate (kernel/model/template.go) which registers SQL functions from kernel/sql/database.go: Any authenticated user - including Publish Service Reader role accounts - can call this endpoint and execute arbitrary SELECT queries. PoC Environment: Exploit: Confirmed response on v3.6.0: Full note dump: Impact Any authenticated user (API token holder, Publish Service Reader) can: - Dump all note content and document hierarchy from the workspace - Exfiltrate tags, custom attributes, block IDs, and timestamps - Search notes for stored passwords, API keys, or personal data…
Recommended action: Upgrade to 3.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services. Affected Code File: /kernel/api/network.go (Lines 153-317) PoC - First, authenticate with your access auth code and copy the authenticated cookie. - Now use the request below for SSRF to Access Cloud Metadata. <img width="1230" height="754" alt="Screenshot 2026-03-11 at 1 23 36 AM" src="https://github.com/user-attachments/assets/60486dba-1ccd-4287-8073-b803854756a2" / Impact - Internal Network Reconnaissance: Attackers can scan internal services - Cloud Credential Theft: Potential access to cloud metadata and IAM credentials - Data Exfiltration: Server can be used as a proxy to access internal resources - Firewall Bypass: Requests…
Recommended action: Upgrade to 3.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260310025236-297bd526708f
Fixed in
0.0.0-20260310025236-297bd526708f· Vendor fix available
Issue
SVG Sanitizer Bypass via Whitespace in javascript: URI — Unauthenticated XSS Summary SiYuan's SVG sanitizer (SanitizeSVG) checks href attributes for the javascript: prefix using strings.HasPrefix(). However, inserting ASCII tab (	), newline ( ), or carriage return ( ) characters inside the javascript: string bypasses this prefix check. Browsers strip these characters per the WHATWG URL specification before parsing the URL scheme, so the JavaScript still executes. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint, creating a reflected XSS. This is a second bypass of the fix for CVE-2026-29183 (fixed in v3.5.9), distinct from the <animate element bypass. Affected Component - File: kernel/util/misc.go - Function: SanitizeSVG() (lines 234-319) - Specific check: Line 271 — strings.HasPrefix(val, "javascript:") - Endpoint: GET /api/icon/getDynamicIcon?type=8&content=... (unauthenticated) - Version: SiYuan <= 3.5.9…
Recommended action: Upgrade to 0.0.0-20260310025236-297bd526708f (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260310025236-297bd526708f
Fixed in
0.0.0-20260310025236-297bd526708f· Vendor fix available
Issue
SVG Sanitizer Bypass via <animate Element — Unauthenticated XSS Summary SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script, <iframe, <foreignobject) and removes on event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements (<animate, <set) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). Affected Component - File: kernel/util/misc.go - Function: SanitizeSVG() (lines 234-319) - Endpoint: GET /api/icon/getDynamicIcon?type=8&content=... (unauthenticated) - Version: SiYuan <= 3.5.9 Root Cause The sanitizer checks attributes on elements at parse time. SVG <animate and <set elements modify attributes at runtime — these elements are not in the sanitizer's…
Recommended action: Upgrade to 0.0.0-20260310025236-297bd526708f (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). Details File: serve.go, session.go Lines: serve.go 303, 315, 320, 340, 955-957; session.go 292-295 Vulnerable Code: Points of Vulnerability: - /export/ trusts url.PathUnescape output and joins it without enforcing fullPath to stay under exportBaseDir. - Double-encoded traversal (%252e%252e) bypasses ServeFile dot-dot URL rejection but is decoded by app logic into ... - CheckAuth grants admin for localhost requests to /export/ when access auth code is set. -…
Recommended action: Upgrade to 3.5.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260304034809-d68bd5a79391
Fixed in
0.0.0-20260304034809-d68bd5a79391· Vendor fix available
Issue
An unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint: - GET /api/icon/getDynamicIcon When type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. Details The issue is caused by unsafe output construction and incomplete sanitization: 1. Endpoint is exposed without auth middleware - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/router.go#L27-L37 - GET /api/icon/getDynamicIcon is registered in the unauthenticated section. 2. User input is inserted into SVG via string formatting - Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L115-L175 - Source:…
Recommended action: Upgrade to 0.0.0-20260304034809-d68bd5a79391 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260118092326-b2274baba2e1
Fixed in
0.0.0-20260118092326-b2274baba2e1· Vendor fix available
Issue
Markdown feature allows unrestricted server side html-rendering which allows arbitary file read (LFD) and fully SSRF access We in @0xL4ugh ( @abdoghazy2015, @xtromera, @A-z4ki, @ZeyadZonkorany and @KarimTantawey) During playing Null CTF 2025 that helps us solved a challenge with unintended way : ) Please note that we used the latest Version and deployed it via this dockerfile : Dockerfile: startup.sh docker-compose.yaml: Details As you can see here : https://github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886 in createDocWithMd function the markdown parameter is being passed to the model.CreateWithMarkdown without any sanitization while here : https://github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035 the input is being passed to luteEngine.Md2BlockDOM(md, false) without any sanitization too PoC Here is a full Python POC ready to run File read <img width="928" height="333" alt="image"…
Recommended action: Upgrade to 0.0.0-20260118092326-b2274baba2e1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260118092521-f8f4b517077b
Fixed in
0.0.0-20260118092521-f8f4b517077b· Vendor fix available
Issue
The SiYuan Note application (v3.5.3) contains a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation Details The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory. PoC The following steps demonstrate how to exfiltrate the /etc/passwd file. 1. The attacker sends a request to copy the system file /etc/passwd to the root of the application workspace (/). <img width="1537" height="357" alt="image" src="https://github.com/user-attachments/assets/7c8e5fe8-f609-4263-8685-eedf3cf22400" / 2. The attacker downloads the copied file using the standard…
Recommended action: Upgrade to 0.0.0-20260118092521-f8f4b517077b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260118021606-5c0cc375b475
Fixed in
0.0.0-20260118021606-5c0cc375b475· Vendor fix available
Issue
Reflected XSS in /api/icon/getDynamicIcon due to unsanitized SVG input. Details The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. PoC Payload: test</text<scriptalert(window.origin)</script<text 1. Open any note and click Change Icon - Dynamic (Text). <img width="713" height="373" alt="image" src="https://github.com/user-attachments/assets/8a4f5ec4-81d6-46cb-8872-841cb2188ed8" / 2. Change color and paste the payload into the Custom field and click on this icon. <img width="935" height="682" alt="image" src="https://github.com/user-attachments/assets/24d28fbd-a3ce-44f1-a5bb-2cc3f711faf5" / 3. Intercept and send the request or get path from devtools <img width="1229" height="627" alt="image"…
Recommended action: Upgrade to 0.0.0-20260118021606-5c0cc375b475 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260116101155-11115da3d0de
Fixed in
0.0.0-20260116101155-11115da3d0de· Vendor fix available
Issue
A Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. Details The application allows authenticated users to upload files, including .svg images, without sanitizing the input to remove embedded JavaScript code (such as <script tags or event handlers). PoC 1. Create a new "Daily note" in the workspace. <img width="1287" height="572" alt="image" src="https://github.com/user-attachments/assets/3a4389b9-695d-4e1b-94dc-72efdb047aa9" / 2. Create a file named test.svg with malicious JavaScript inside: 3. Upload a file in current daily note: <img width="1617" height="316" alt="image" src="https://github.com/user-attachments/assets/6e14318a-08ec-48e5-b278-9174ad17cfcb" / <img width="1482" height="739" alt="image"…
Recommended action: Upgrade to 0.0.0-20260116101155-11115da3d0de (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.