github.com/siyuan-note/siyuan/kernel

CRITICAL 9.0

Go

CVE-2026-45375

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

May 13, 2026

UNKNOWN

Go

CVE-2026-44588

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

May 8, 2026

UNKNOWN

Go

CVE-2026-44670

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

May 8, 2026

UNKNOWN

Go

CVE-2026-45375

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution in github.com/siyuan-note/siyuan/kernel

May 20, 2026

UNKNOWN

Go

CVE-2026-44588

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585) in github.com/siyuan-note/siyuan/kernel

May 20, 2026

UNKNOWN

Go

CVE-2026-44670

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE in github.com/siyuan-note/siyuan/kernel

May 20, 2026

MEDIUM 4.3

Go

CVE-2026-45147

SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

May 13, 2026

UNKNOWN

Go

CVE-2026-45371

SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

May 13, 2026

MEDIUM 4.3

Go

CVE-2026-45148

SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode

May 13, 2026

HIGH 8.5

Go

CVE-2026-40318

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

Apr 10, 2026

UNKNOWN

Go

CVE-2026-41894

SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)

Apr 22, 2026

MEDIUM 5.4

Go

CVE-2026-40922

SiYuan has incomplete fix for CVE-2026-33066: XSS

Apr 14, 2026

HIGH 8.1

Go

CVE-2026-40259

SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView`

Apr 10, 2026

UNKNOWN

Go

CVE-2026-40107

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

Apr 10, 2026

CRITICAL 9.0

Go

CVE-2026-39846

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

Apr 8, 2026

MEDIUM 6.1

Go

CVE-2026-34605

SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated)

Apr 1, 2026

HIGH 8.6

Go

CVE-2026-34585

SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution

Apr 1, 2026

CRITICAL 9.0

Go

CVE-2026-34448

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

Mar 31, 2026

CRITICAL 9.6

Go

CVE-2026-34449

SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

Mar 31, 2026

HIGH 7.5

Go

CVE-2026-34453

SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark

Mar 31, 2026

CRITICAL 9.3

Go

CVE-2026-29183

SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint

Mar 4, 2026

CRITICAL 9.9

Go

CVE-2026-32938

SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service

Mar 17, 2026

CRITICAL 9.8

Go

CVE-2026-32767

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

Mar 16, 2026

UNKNOWN

Go

CVE-2026-32815

SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

Mar 16, 2026

UNKNOWN

Go

CVE-2026-32751

SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

Mar 16, 2026

HIGH 7.6

Go

CVE-2026-32749

SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write

Mar 16, 2026

MEDIUM 6.8

Go

CVE-2026-32747

SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets

Mar 16, 2026

MEDIUM 6.5

Go

CVE-2026-32704

SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB

Mar 13, 2026

CRITICAL 9.8

Go

CVE-2026-33670

SiYuan has directory traversal within its publishing service

Mar 25, 2026

CRITICAL 9.8

Go

CVE-2026-33669

SiYuan has Arbitrary Document Reading within the Publishing Service

Mar 25, 2026

UNKNOWN

Go

CVE-2026-33669

SiYuan has Arbitrary Document Reading within the Publishing Service in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33670

SiYuan has directory traversal within its publishing service in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

UNKNOWN

Go

CVE-2026-32704

SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

UNKNOWN

Go

CVE-2026-32751

SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

UNKNOWN

Go

CVE-2026-32767

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

UNKNOWN

Go

CVE-2026-32938

SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

UNKNOWN

Go

CVE-2026-32749

SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

UNKNOWN

Go

CVE-2026-32815

SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

UNKNOWN

Go

CVE-2026-32747

SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets in github.com/siyuan-note/siyuan/kernel

Mar 26, 2026

MEDIUM 6.8

Go

CVE-2026-33194

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)

Mar 18, 2026

HIGH 7.5

Go

CVE-2026-33476

Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal

Mar 20, 2026

HIGH 7.5

Go

CVE-2026-33203

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

Mar 18, 2026

UNKNOWN

Go

CVE-2026-33066

SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

Mar 18, 2026

UNKNOWN

Go

CVE-2026-33067

SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

Mar 18, 2026

UNKNOWN

Go

CVE-2026-33476

Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal in github.com/siyuan-note/siyuan/kernel

Mar 23, 2026

UNKNOWN

Go

CVE-2026-33203

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass in github.com/siyuan-note/siyuan/kernel

Mar 23, 2026

UNKNOWN

Go

CVE-2026-33194

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass) in github.com/siyuan-note/siyuan/kernel

Mar 23, 2026

UNKNOWN

Go

CVE-2026-33067

SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata in github.com/siyuan-note/siyuan/kernel

Mar 23, 2026

UNKNOWN

Go

CVE-2026-33066

SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering in github.com/siyuan-note/siyuan/kernel

Mar 23, 2026

HIGH 8.3

Go

CVE-2026-32110

SiYuan has a Full-Read SSRF via /api/network/forwardProxy

Mar 12, 2026

CRITICAL 9.3

Go

CVE-2026-30869

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

Mar 7, 2026

UNKNOWN

Go

CVE-2026-29073

SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access

Mar 3, 2026

UNKNOWN

Go

CVE-2026-31807

SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

Mar 10, 2026

UNKNOWN

Go

CVE-2026-31809

SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

Mar 10, 2026

HIGH 7.1

Go

CVE-2026-30926

SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren

Mar 9, 2026

UNKNOWN

Go

CVE-2026-29183

SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint in github.com/siyuan-note/siyuan/kernel

Mar 10, 2026

UNKNOWN

Go

CVE-2026-29073

SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access in github.com/siyuan-note/siyuan/kernel

Mar 10, 2026

UNKNOWN

Go

CVE-2026-32110

SiYuan has a Full-Read SSRF via /api/network/forwardProxy in github.com/siyuan-note/siyuan/kernel

Mar 12, 2026

UNKNOWN

Go

CVE-2026-31809

SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS in github.com/siyuan-note/siyuan/kernel

Mar 12, 2026

UNKNOWN

Go

CVE-2026-31807

SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS in github.com/siyuan-note/siyuan/kernel

Mar 12, 2026

UNKNOWN

Go

CVE-2026-30926

SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren in github.com/siyuan-note/siyuan/kernel

Mar 11, 2026

UNKNOWN

Go

CVE-2026-30869

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage in github.com/siyuan-note/siyuan/kernel

Mar 10, 2026

UNKNOWN

Go

CVE-2026-23851

SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in github.com/siyuan-note/siyuan/kernel

Feb 3, 2026

UNKNOWN

Go

CVE-2026-25539

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE in github.com/siyuan-note/siyuan/kernel

Feb 2, 2026

UNKNOWN

Go

CVE-2026-23847

SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel

Feb 3, 2026

UNKNOWN

Go

CVE-2026-23850

SiYuan vulnerable to Arbitrary file Read / SSRF in github.com/siyuan-note/siyuan/kernel

Feb 3, 2026

UNKNOWN

Go

CVE-2026-23645

SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload in github.com/siyuan-note/siyuan/kernel

Feb 3, 2026

UNKNOWN

Go

GHSA-4r66-7rcv-x46x

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin in github.com/siyuan-note/siyuan/kernel

Dec 15, 2025

UNKNOWN

Go

CVE-2025-67488

SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE in github.com/siyuan-note/siyuan/kernel

Dec 15, 2025

UNKNOWN

Go

CVE-2025-21609

SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel

Jan 7, 2025

UNKNOWN

Go

CVE-2024-55657

SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel

Dec 12, 2024

UNKNOWN

Go

CVE-2024-55660

SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel

Dec 12, 2024

UNKNOWN

Go

CVE-2024-55658

SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel

Dec 12, 2024

UNKNOWN

Go

CVE-2024-55659

SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel

Dec 12, 2024

HIGH 7.5

Go

CVE-2026-25992

SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal

Jan 28, 2026

UNKNOWN

Go

CVE-2026-25992

SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal in github.com/siyuan-note/siyuan/kernel

Feb 2, 2026

CRITICAL 9.1

Go

CVE-2026-25539

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

Jan 29, 2026

UNKNOWN

Go

CVE-2026-23851

SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

Jan 21, 2026

UNKNOWN

Go

CVE-2026-23645

SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload

Jan 16, 2026

MEDIUM 4.6

Go

CVE-2026-23847

SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

Jan 21, 2026

UNKNOWN

Go

CVE-2026-23850

SiYuan vulnerable to Arbitrary file Read / SSRF

Jan 21, 2026

HIGH 7.8

Go

CVE-2025-67488

SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

Dec 9, 2025

UNKNOWN

Go

GO-2025-4219

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

Dec 9, 2025

HIGH 7.5

Go

CVE-2024-55658

SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

Dec 11, 2024

HIGH 7.5

Go

CVE-2024-55657

SiYuan has an arbitrary file read via /api/template/render

Dec 11, 2024

UNKNOWN

Go

CVE-2025-21609

SiYuan has an arbitrary file deletion vulnerability

Jan 3, 2025

UNKNOWN

Go

CVE-2024-55660

SiYuan has an SSTI via /api/template/renderSprig

Dec 11, 2024

UNKNOWN

Go

CVE-2024-55659

SiYuan has an arbitrary file write in the host via /api/asset/upload

Dec 11, 2024