Start for Free
go

github.com/siyuan-note/siyuan/kernel

View on go registry
100 Total advisories
100 Vulnerabilities
0 Malware

Dependency scanning

Check whether github.com/siyuan-note/siyuan/kernel is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

MEDIUM 5.8
Go

GO-2026-6836

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
MEDIUM 5.8
Go

CVE-2026-73049

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
MEDIUM 6.6
Go

CVE-2026-62204

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
MEDIUM 5.8
Go

CVE-2026-73630

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
MEDIUM 4.9
Go

CVE-2026-60083

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files
HIGH 7.5
Go

CVE-2026-73054

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
UNKNOWN
Go

CVE-2026-60083

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

GHSA-xp3q-r38w-vgqm

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-73054

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-62204

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-73630

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-73049

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers in github.com/siyuan-note/siyuan/kernel
HIGH 8.3
Go

CVE-2026-32110

SiYuan has a Full-Read SSRF via /api/network/forwardProxy
MEDIUM 6.8
Go

CVE-2026-33194

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
MEDIUM 6.5
Go

CVE-2026-32704

SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB
HIGH 7.5
Go

CVE-2026-33203

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
UNKNOWN
Go

CVE-2026-73608

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel
HIGH 8.6
Go

CVE-2026-73608

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
UNKNOWN
Go

CVE-2026-72791

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel
MEDIUM 5.8
Go

CVE-2026-72791

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews
MEDIUM 5.8
Go

GHSA-vg9q-fc8f-43f3

Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
MEDIUM 6.6
Go

GHSA-989h-w3q9-3m2f

Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
MEDIUM 5.8
Go

GHSA-6xvp-3rfv-g2g2

Duplicate Advisory: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
HIGH 7.5
Go

GHSA-hg5w-8ppq-wpjq

Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6
HIGH 7.5
Go

CVE-2026-74904

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
UNKNOWN
Go

CVE-2026-82233

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel
MEDIUM 5.7
Go

CVE-2026-82233

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)
MEDIUM 5.8
Go

CVE-2026-73609

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
UNKNOWN
Go

CVE-2026-85175

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-85175

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)
MEDIUM 5.8
Go

CVE-2026-73607

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
MEDIUM 5.8
Go

CVE-2026-72788

SiYuan discloses an administrator's open documents and search terms to anonymous readers
UNKNOWN
Go

CVE-2026-82234

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernel
HIGH 8.2
Go

CVE-2026-82234

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)
MEDIUM 5.8
Go

CVE-2026-73606

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
NONE 0.0
Go

CVE-2026-74802

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
CRITICAL 10.0
Go

CVE-2026-69085

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
UNKNOWN
Go

CVE-2026-82651

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel
MEDIUM 4.9
Go

CVE-2026-82651

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
MEDIUM 5.8
Go

CVE-2026-73605

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
UNKNOWN
Go

CVE-2026-73606

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-69085

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-72788

SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-74802

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-73605

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-73607

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-73609

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-74904

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel
HIGH 7.5
Go

GHSA-69jp-f2p8-9vrg

Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
HIGH 8.2
Go

GHSA-x8p6-569w-fmmr

Duplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
MEDIUM 5.8
Go

GHSA-gq43-vcrh-6jw8

Duplicate Advisory: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
HIGH 8.6
Go

GHSA-75xh-mp4f-f2rf

Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
MEDIUM 5.8
Go

GHSA-7v6h-j59w-8qfp

Duplicate Advisory: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
MEDIUM 5.8
Go

GHSA-xxm9-w59q-m66x

Duplicate Advisory: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
CRITICAL 10.0
Go

GHSA-5w4j-hchp-r332

Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
MEDIUM 5.8
Go

GHSA-v372-phq5-6mx6

Duplicate Advisory: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
MEDIUM 5.8
Go

GHSA-hpmw-8pgp-x77j

Duplicate Advisory: SiYuan discloses an administrator's open documents and search terms to anonymous readers
CRITICAL 9.6
Go

GHSA-24r3-p3x6-cqvx

Duplicate Advisory: SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS
UNKNOWN
Go

CVE-2026-56395

SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS
MEDIUM 5.8
Go

CVE-2026-72808

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)
HIGH 8.6
Go

CVE-2026-72789

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked
MEDIUM 5.8
Go

CVE-2026-72790

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo
HIGH 8.6
Go

CVE-2026-68587

SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check
HIGH 8.6
Go

CVE-2026-72810

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)
HIGH 7.7
Go

CVE-2026-59832

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
HIGH 8.6
Go

CVE-2026-72795

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers
MEDIUM 5.8
Go

CVE-2026-72799

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
MEDIUM 5.8
Go

CVE-2026-72797

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers
HIGH 8.0
Go

CVE-2026-72809

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy
MEDIUM 5.3
Go

CVE-2026-72802

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
HIGH 7.5
Go

CVE-2026-72801

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking
HIGH 8.6
Go

CVE-2026-72804

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents
MEDIUM 5.8
Go

CVE-2026-72796

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers
MEDIUM 5.8
Go

CVE-2026-72800

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
MEDIUM 6.5
Go

CVE-2026-72812

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)
MEDIUM 5.8
Go

CVE-2026-72806

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)
HIGH 7.5
Go

CVE-2026-59834

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
HIGH 7.7
Go

CVE-2026-69086

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure
HIGH 8.6
Go

CVE-2026-72798

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns
CRITICAL 10.0
Go

CVE-2026-69084

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write
HIGH 8.0
Go

CVE-2026-72807

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel
HIGH 8.6
Go

CVE-2026-68586

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered
UNKNOWN
Go

CVE-2026-65607

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) in github.com/siyuan-note/siyuan/kernel
MEDIUM 6.5
Go

CVE-2026-65607

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
MEDIUM 5.8
Go

CVE-2026-72805

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents
CRITICAL 10.0
Go

CVE-2026-69083

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
HIGH 8.6
Go

CVE-2026-72793

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers
HIGH 8.6
Go

CVE-2026-72794

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
HIGH 8.6
Go

CVE-2026-68584

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
MEDIUM 5.8
Go

CVE-2026-72803

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents
MEDIUM 5.8
Go

CVE-2026-72792

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password
UNKNOWN
Go

CVE-2026-66394

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass in github.com/siyuan-note/siyuan/kernel
HIGH 8.7
Go

CVE-2026-66394

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass
CRITICAL 10.0
Go

CVE-2026-72811

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle
MEDIUM 5.8
Go

CVE-2026-68585

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered
UNKNOWN
Go

CVE-2026-72792

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-72796

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-72793

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-72804

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel
UNKNOWN
Go

CVE-2026-72789

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked in github.com/siyuan-note/siyuan/kernel

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes