github.com/siyuan-note/siyuan/kernel vulnerabilities (Go)
114 vulnerabilities.
github.com/siyuan-note/siyuan/kernelGoSiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass9.3 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan before v3.7.2 Path Traversal via /export/temp/7.1 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db7.7 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: SQL Query in Block Search Exposes Hidden Published Document Content7.5 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content9.9 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()9.9 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Stored XSS in Bazaar marketplace via package README event handlers7.1 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist9.2 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon5.9 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()9.9 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)7.5 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution9.0 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs7.2 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata4.3 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk4.3 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS9.4 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan9.4 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint7.1 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)5.3 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`8.5 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API8.1 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering8.7 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions9.1 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )8.6 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution8.6 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection9.7 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client9.1 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content7.5 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan has directory traversal within its publishing service9.8 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan has Arbitrary Document Reading within the Publishing Service9.8 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan has an Unauthenticated Arbitrary File Read via Path Traversal7.5 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass7.5 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home6.8 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata5.3 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering5.3 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan has an Arbitrary File Read in its Desktop Publish Service9.9 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API9.8 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README9.4 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar...9.4 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface5.1 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write7.6 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure5.3 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets6.8 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan renderSprig: missing admin check allows any user to read full workspace DB6.5 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan has a Full-Read SSRF via /api/network/forwardProxy8.3 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS6.4 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS6.4 Mediumgithub.com/siyuan-note/siyuan/kernelGoSiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content7.1 Highgithub.com/siyuan-note/siyuan/kernelGoSiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage9.3 Criticalgithub.com/siyuan-note/siyuan/kernelGoSiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution9.3 Critical- Show moreLoading…