Skip to contentSiyuan-note Siyuan vulnerabilities
- siyuan-note siyuanSiYuan 3.7.0 before 3.8.10 Path Traversal File Write via MCP web_fetchCVE-2026-1267766.0 Medium
- siyuan-note siyuanSiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/readCVE-2026-1234926.9 Medium
- siyuan-note siyuanSiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT AliasCVE-2026-1186805.9 Medium
- siyuan-note siyuanSiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length PrefixCVE-2026-1161715.9 Medium
- siyuan-note siyuanSiYuan before v3.8.7 SQL Injection via History Search op and queryCVE-2026-1161706.9 Medium
- siyuan-note siyuanSiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math BlocksCVE-2026-1161695.1 Medium
- siyuan-note siyuanSiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset ToolCVE-2026-1161686.9 Medium
- siyuan-note siyuanSiYuan 2.9.0 before 3.8.7 XSS via check-auth to ParameterCVE-2026-1161677.6 High
- siyuan-note siyuanSiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS SettingCVE-2026-1161667.6 High
- siyuan-note siyuanSiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon TemplateCVE-2026-1093107.1 High
- siyuan-note siyuanSiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.PathCVE-2026-1093096.9 Medium
- siyuan-note siyuanSiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfoCVE-2026-1052056.9 Medium
- siyuan-note siyuanSiYuan before 3.8.5 Information Disclosure via /api/export/previewCVE-2026-1044108.7 High
- siyuan-note siyuanSiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfoCVE-2026-1037636.9 Medium
- siyuan-note siyuanSiYuan before v3.8.5 Missing Authorization in Save-Path Resolver EndpointsCVE-2026-1037626.9 Medium
- siyuan-note siyuanSiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImagesCVE-2026-1010926.9 Medium
- siyuan-note siyuanSiYuan before v3.8.4 SQL Injection via Block Query EmbedCVE-2026-1010917.1 High
- siyuan-note siyuanSiYuan before v3.8.4 Authentication Bypass via Missing Origin HeaderCVE-2026-1006468.6 High
- siyuan-note siyuanSiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery KanbanCVE-2026-1006458.6 High
- siyuan-note siyuanSiYuan before v3.8.4 SQL Injection via dailyNoteSavePathCVE-2026-1006448.7 High
- siyuan-note siyuanSiYuan before v3.8.4 Stored XSS via Attribute View textareaCVE-2026-1006438.5 High
- siyuan-note siyuanSiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuthCVE-2026-1006427.2 High
- siyuan-note siyuanSiYuan before v3.8.4 Stored XSS via Unescaped Flashcard ContentCVE-2026-1006418.6 High
- siyuan-note siyuanSiYuan before v3.8.4 Clipboard Data Disclosure via IPCCVE-2026-1006408.6 High
- siyuan-note siyuanSiYuan before v3.8.4 Cross-Site Scripting via Kramdown IALCVE-2026-1006398.6 High
- siyuan-note siyuanSiYuan before v3.8.4 Path Traversal via setNotebookIconCVE-2026-1006388.3 High
- siyuan-note siyuanSiYuan before v3.8.4 Path Traversal via checkoutRepo sessionIDCVE-2026-1006378.3 High
- siyuan-note siyuanSiYuan before v3.8.4 Path Traversal via exportBrowserHTML folderCVE-2026-1006368.3 High
- siyuan-note siyuanSiYuan before v3.8.4 Authentication Bypass via Plaintext Session CookieCVE-2026-1006358.2 High
- siyuan-note siyuanSiYuan before v3.8.4 Missing Authorization via siyuan-send-windowsCVE-2026-1006345.3 Medium
- siyuan-note siyuanSiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File OperationsCVE-2026-100633Public exploit8.5 High
- siyuan-note siyuanSiYuan through 3.8.4 Stored XSS via Heading Style AttributeCVE-2026-939238.6 High
- siyuan-note siyuanSiYuan through 3.8.4 Stored XSS via notebook namesCVE-2026-939228.6 High
- siyuan-note siyuanSiYuan through 3.8.4 Access Control Bypass via Dynamic Icon EndpointCVE-2026-939215.3 Medium
- siyuan-note siyuanSiYuan before 3.8.3 SQL Injection via unescaped tag in graph.goCVE-2026-935917.2 High
- siyuan-note siyuanSiYuan before 3.8.4 Cross-Site Scripting via Document TitleCVE-2026-929868.6 High
- siyuan-note siyuanSiYuan before 3.8.4 Cross-Site Scripting via Bookmark LabelsCVE-2026-929858.6 High
- siyuan-note siyuanSiYuan before v3.8.2 Path Traversal via removeRiffDeckCVE-2026-878158.4 High
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via Asset PreviewCVE-2026-878148.4 High
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via unescaped asset filenamesCVE-2026-878138.4 High
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via Bazaar iconURLCVE-2026-878127.4 High
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via notebook template pathsCVE-2026-878118.4 High
- siyuan-note siyuanSiyuan before v3.8.2 Information Disclosure via fullTextSearchBlockCVE-2026-878106.9 Medium
- siyuan-note siyuanSiyuan before v3.8.2 Information Disclosure via Export PreviewCVE-2026-878097.1 High
- siyuan-note siyuanSiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlockCVE-2026-878088.7 High
- siyuan-note siyuansiyuan before v3.8.2 SQL Injection via fullTextSearchBlockCVE-2026-878078.7 High
- siyuan-note siyuanSiYuan before 3.8.2 Remote Code Execution via ClipboardCVE-2026-867128.6 High
- siyuan-note siyuanSiYuan before v3.8.2 Information Disclosure via Attribute-ViewCVE-2026-861927.1 High
- siyuan-note siyuanSiYuan before v3.8.2 Private Attribute View Key EnumerationCVE-2026-861915.3 Medium
- siyuan-note siyuanSiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrencyCVE-2026-855858.7 High
- Show olderLoading…