Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 216

Export CSV
CVE-2026-92985

SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-92986

SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87814

SiYuan before v3.8.2 Stored XSS via Asset Preview

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYuan origin when victims preview the assets, enabling authenticated API requests and workspace manipulation.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87809

Siyuan before v3.8.2 Information Disclosure via Export Preview

Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-85583

SiYuan before v3.8.2 Path Traversal via symlink in file API

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87815

SiYuan before v3.8.2 Path Traversal via removeRiffDeck

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-85578

SiYuan through 3.8.1 Authorization Bypass via getFile

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87810

Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87811

SiYuan before v3.8.2 Stored XSS via notebook template paths

SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling same-origin API requests and application state manipulation.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87807

siyuan before v3.8.2 SQL Injection via fullTextSearchBlock

siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and sensitive attributes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87808

SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock

SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87812

SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated SiYuan origin when users view Bazaar listings, enabling API requests and application state manipulation.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87813

SiYuan before v3.8.2 Stored XSS via unescaped asset filenames

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-86192

SiYuan before v3.8.2 Information Disclosure via Attribute-View

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-85581

SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration

SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-86712

SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-86191

SiYuan before v3.8.2 Private Attribute View Key Enumeration

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-85584

SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-85579

SiYuan before v3.8.2 Information Disclosure via undoState

SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-85174

SiYuan before v3.8.2 API Token Exposure via Log File

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan