B3log Siyuan vulnerabilities

• b3log siyuan SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE CVE-2026-40322 9.1 CriticalApril 16, 2026
• b3log siyuan SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066) CVE-2026-40922 Fix available 5.3 MediumApril 14, 2026
• b3log siyuan SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView` CVE-2026-40318 Fix available 8.5 HighApril 10, 2026
• b3log siyuan SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API CVE-2026-40259 Fix available 8.1 HighApril 10, 2026
• b3log siyuan SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering CVE-2026-40107 Fix available 8.7 HighApril 9, 2026
• b3log siyuan SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions CVE-2026-39846 Fix available 9.1 CriticalApril 7, 2026
• b3log siyuan SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated ) CVE-2026-34605 Fix available 8.6 HighMarch 31, 2026
• b3log siyuan SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution CVE-2026-34585 Fix available 8.6 HighMarch 31, 2026
• b3log siyuan SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection CVE-2026-34449 Fix available 9.7 CriticalMarch 31, 2026
• b3log siyuan SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client CVE-2026-34448 Fix available 9.1 CriticalMarch 31, 2026
• b3log siyuan SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content CVE-2026-34453 Fix available 7.5 HighMarch 31, 2026
• b3log siyuan SiYuan has directory traversal within its publishing service CVE-2026-33670 9.8 CriticalMarch 25, 2026
• b3log siyuan SiYuan has Arbitrary Document Reading within the Publishing Service CVE-2026-33669 9.8 CriticalMarch 25, 2026
• b3log siyuan SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal CVE-2026-33476 7.5 HighMarch 20, 2026
• b3log siyuan SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass CVE-2026-33203 Fix available 7.5 HighMarch 18, 2026
• b3log siyuan SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home CVE-2026-33194 Fix available 6.8 MediumMarch 18, 2026
• b3log siyuan SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata CVE-2026-33067 Public exploitFix available 5.3 MediumMarch 18, 2026
• b3log siyuan SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering CVE-2026-33066 Fix available 5.3 MediumMarch 18, 2026
• b3log siyuan SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) CVE-2026-32940 9.3 CriticalMarch 17, 2026
• b3log siyuan SiYuan has an Arbitrary File Read in its Desktop Publish Service CVE-2026-32938 9.9 CriticalMarch 17, 2026
• b3log siyuan SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API CVE-2026-32767 9.8 CriticalMarch 16, 2026
• b3log siyuan SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface CVE-2026-32751 5.1 MediumMarch 16, 2026
• b3log siyuan SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes CVE-2026-32750 6.8 MediumMarch 16, 2026
• b3log siyuan SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write CVE-2026-32749 7.6 HighMarch 16, 2026
• b3log siyuan SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure CVE-2026-32815 5.3 MediumMarch 16, 2026
• b3log siyuan SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets CVE-2026-32747 6.8 MediumMarch 16, 2026
• b3log siyuan SiYuan renderSprig: missing admin check allows any user to read full workspace DB CVE-2026-32704 Fix available 6.5 MediumMarch 13, 2026
• b3log siyuan SiYuan has a Full-Read SSRF via /api/network/forwardProxy CVE-2026-32110 Fix available 8.3 HighMarch 11, 2026
• b3log siyuan SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS CVE-2026-31809 Fix available 6.4 MediumMarch 10, 2026
• b3log siyuan SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS CVE-2026-31807 Fix available 6.4 MediumMarch 10, 2026
• b3log siyuan SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content CVE-2026-30926 7.1 HighMarch 9, 2026
• b3log siyuan SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage CVE-2026-30869 Fix available 9.3 CriticalMarch 7, 2026
• b3log siyuan SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution CVE-2026-29183 Fix available 9.3 CriticalMarch 4, 2026
• b3log siyuan SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access CVE-2026-29073 5.7 MediumMarch 3, 2026
• b3log siyuan Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink CVE-2026-25647 4.6 MediumFebruary 6, 2026
• b3log siyuan SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE CVE-2026-25539 9.1 CriticalJanuary 29, 2026
• b3log siyuan SiYuan has a File Read Interface Case Bypass Vulnerability CVE-2026-25992 7.5 HighJanuary 28, 2026
• b3log siyuan SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute CVE-2026-23852 5.8 MediumJanuary 19, 2026
• b3log siyuan SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality CVE-2026-23851 Fix available 8.3 HighJanuary 19, 2026
• b3log siyuan SiYuan vulnerable to arbitrary file read CVE-2026-23850 Fix available 7.8 HighJanuary 19, 2026
• b3log siyuan SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon CVE-2026-23847 Fix available 2.1 LowJanuary 19, 2026
• b3log siyuan SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload CVE-2026-23645 Fix available 5.3 MediumJanuary 16, 2026
• b3log siyuan SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret CVE-2025-68948 6.9 MediumDecember 27, 2025
• b3log siyuan SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE CVE-2025-67488 7.8 HighDecember 9, 2025
• b3log siyuan SiYuan has an arbitrary file deletion vulnerability CVE-2025-21609 Fix available 8.7 HighJanuary 3, 2025
• b3log siyuan SiYuan has an arbitrary file read via /api/template/render CVE-2024-55657 8.7 HighDecember 11, 2024
• b3log siyuan SiYuan has an arbitrary file read and path traversal via /api/export/exportResources CVE-2024-55658 8.7 HighDecember 11, 2024
• b3log siyuan SiYuan has an arbitrary file write in the host via /api/asset/upload CVE-2024-55659 8.7 HighDecember 11, 2024
• b3log siyuan SiYuan has an SSTI via /api/template/renderSprig CVE-2024-55660 6.9 MediumDecember 11, 2024
• b3log siyuan A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. CVE-2024-53507 9.8 CriticalNovember 29, 2024
• Show olderLoading…