Skip to contentSiyuan-note vulnerabilities
Newest
- siyuan-note siyuanSiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.dbCVE-2026-59832Fix available7.7 High
- siyuan-note siyuanSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)CVE-2026-598338.6 High
- siyuan-note siyuanSiYuan: SQL Query in Block Search Exposes Hidden Published Document ContentCVE-2026-59834Fix available7.5 High
- siyuan-note siyuanSiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)CVE-2026-555709.0 Critical
- siyuan-note siyuanSiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron clientCVE-2026-547598.7 High
- siyuan-note siyuanSiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentCVE-2026-50551Fix available9.9 Critical
- siyuan-note siyuanSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()CVE-2026-54158Fix available9.9 Critical
- siyuan-note siyuanSiYuan: Stored XSS in Bazaar marketplace via package README event handlersCVE-2026-54070Fix available7.1 High
- siyuan-note siyuanSiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin AllowlistCVE-2026-54069Fix available9.2 Critical
- siyuan-note siyuanSiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIconCVE-2026-54068Fix available5.9 Medium
- siyuan-note siyuanSiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()CVE-2026-54067Fix available9.9 Critical
- siyuan-note siyuanSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)CVE-2026-54066Fix available7.5 High
- siyuan-note siyuanSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code executionCVE-2026-445868.3 High
- siyuan-note siyuanSiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionCVE-2026-453759.0 Critical
- siyuan-note siyuanSiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIsCVE-2026-45371Fix available7.2 High
- siyuan-note siyuanSiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadataCVE-2026-45148Fix available4.3 Medium
- siyuan-note siyuanSiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to diskCVE-2026-45147Fix available4.3 Medium
- siyuan-note siyuanSiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSSCVE-2026-445889.4 Critical
- siyuan-note siyuanSiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuanCVE-2026-44670Fix available9.4 Critical
- siyuan-note siyuanSiYuan Desktop Notification XSS Leads to Electron RCECVE-2026-414218.8 High
- siyuan-note siyuanSiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` EndpointCVE-2026-41894Fix available7.1 High
- b3log siyuanSiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCECVE-2026-403229.1 Critical
- b3log siyuanSiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)CVE-2026-40922Fix available5.3 Medium
- b3log siyuanSiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`CVE-2026-40318Fix available8.5 High
- b3log siyuanSiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView APICVE-2026-40259Fix available8.1 High
- b3log siyuanSiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram RenderingCVE-2026-40107Fix available8.7 High
- b3log siyuanSiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captionsCVE-2026-39846Fix available9.1 Critical
- b3log siyuanSiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )CVE-2026-34605Fix available8.6 High
- b3log siyuanSiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command executionCVE-2026-34585Fix available8.6 High
- b3log siyuanSiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet InjectionCVE-2026-34449Fix available9.7 Critical
- b3log siyuanSiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop clientCVE-2026-34448Fix available9.1 Critical
- b3log siyuanSiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked contentCVE-2026-34453Fix available7.5 High
- b3log siyuanSiYuan has directory traversal within its publishing serviceCVE-2026-336709.8 Critical
- b3log siyuanSiYuan has Arbitrary Document Reading within the Publishing ServiceCVE-2026-336699.8 Critical
- b3log siyuanSiYuan has an Unauthenticated Arbitrary File Read via Path TraversalCVE-2026-334767.5 High
- b3log siyuanSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive BypassCVE-2026-33203Fix available7.5 High
- b3log siyuanSiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /homeCVE-2026-33194Fix available6.8 Medium
- b3log siyuanSiYuan has Stored XSS to RCE via Unsanitized Bazaar Package MetadataCVE-2026-33067Public exploitFix available5.3 Medium
- b3log siyuanSiYuan has Stored XSS to RCE via Unsanitized Bazaar README RenderingCVE-2026-33066Fix available5.3 Medium
- b3log siyuanSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)CVE-2026-329409.3 Critical
- b3log siyuanSiYuan has an Arbitrary File Read in its Desktop Publish ServiceCVE-2026-329389.9 Critical
- b3log siyuanSiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search APICVE-2026-327679.8 Critical
- siyuanSiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and READMECVE-2026-563979.4 Critical
- b3log siyuanSiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile InterfaceCVE-2026-327515.1 Medium
- b3log siyuanSiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notesCVE-2026-327506.8 Medium
- b3log siyuanSiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file writeCVE-2026-327497.6 High
- b3log siyuanSiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information DisclosureCVE-2026-328155.3 Medium
- b3log siyuanSiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secretsCVE-2026-327476.8 Medium
- b3log siyuanSiYuan renderSprig: missing admin check allows any user to read full workspace DBCVE-2026-32704Fix available6.5 Medium
- b3log siyuanSiYuan has a Full-Read SSRF via /api/network/forwardProxyCVE-2026-32110Fix available8.3 High
- Show moreLoading…