github.com/siyuan-note/siyuan/kernel (Go)

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

EPSS 0.30%

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

EPSS 0.30%

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

EPSS 0.33%

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

EPSS 0.33%

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

EPSS 0.33%

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

EPSS 0.33%

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

EPSS 0.48%

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

EPSS 0.48%

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

EPSS 0.36%

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

EPSS 0.36%

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)

EPSS 0.40%

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)

EPSS 0.40%

Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

EPSS 0.09%

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files

EPSS 0.39%

Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

EPSS 0.45%

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

EPSS 0.45%

Duplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

EPSS 0.16%

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

EPSS 0.16%

Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

EPSS 0.41%

Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

Duplicate Advisory: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

Duplicate Advisory: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

Duplicate Advisory: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

EPSS 0.34%

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

EPSS 0.33%

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

EPSS 0.38%

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

EPSS 0.38%

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

EPSS 0.44%

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

EPSS 0.44%

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

EPSS 0.54%

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

EPSS 0.54%

Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Duplicate Advisory: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

Duplicate Advisory: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

Duplicate Advisory: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

Duplicate Advisory: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

EPSS 0.33%

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

EPSS 0.33%

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

EPSS 0.25%

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

EPSS 0.25%

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

EPSS 0.33%

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

EPSS 0.33%

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

EPSS 0.33%

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

EPSS 0.33%

Duplicate Advisory: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

Duplicate Advisory: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

Duplicate Advisory: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

Duplicate Advisory: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

Duplicate Advisory: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port prox

Duplicate Advisory: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

Duplicate Advisory: Absolute filesystem path and OS username disclosure via resolveAssetPath

Duplicate Advisory: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

Duplicate Advisory: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

Duplicate Advisory: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

Duplicate Advisory: getEncryptedNotebookStatus discloses names and live unlock state of all encrypted notebooks to anonymous readers

Duplicate Advisory: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

Duplicate Advisory: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

Duplicate Advisory: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

Duplicate Advisory: SiYuan discloses an administrator's open documents and search terms to anonymous readers

Duplicate Advisory: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

Duplicate Advisory: Tag labels from password-protected documents are returned to readers who have not entered the password

Duplicate Advisory: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

Duplicate Advisory: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

Duplicate Advisory: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

EPSS 0.30%

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

EPSS 0.30%

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

EPSS 0.35%

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

EPSS 0.35%

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

EPSS 0.33%

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

EPSS 0.33%

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

EPSS 0.38%

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

EPSS 0.38%

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

EPSS 0.30%

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

EPSS 0.30%

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

EPSS 0.43%

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

EPSS 0.43%

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

EPSS 0.30%

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

EPSS 0.30%

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

EPSS 0.30%

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

EPSS 0.30%

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

EPSS 0.30%

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

EPSS 0.30%

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

EPSS 0.33%

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

EPSS 0.33%

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

EPSS 0.33%

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

EPSS 0.33%

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

EPSS 0.43%

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

EPSS 0.43%

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

EPSS 0.30%

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

EPSS 0.30%

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

EPSS 0.35%

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

EPSS 0.35%

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

EPSS 0.30%

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

EPSS 0.30%

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

EPSS 0.33%

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

EPSS 0.33%

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

EPSS 0.30%

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

EPSS 0.30%

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

EPSS 0.33%

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

EPSS 0.33%

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

EPSS 0.33%

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

EPSS 0.33%

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

EPSS 0.37%

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

EPSS 0.37%

SiYuan discloses an administrator's open documents and search terms to anonymous readers

EPSS 0.38%

SiYuan discloses an administrator's open documents and search terms to anonymous readers

EPSS 0.38%

Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Duplicate Advisory: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

Duplicate Advisory: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

Duplicate Advisory: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

Duplicate Advisory: SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

Duplicate Advisory: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

EPSS 0.53%

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

EPSS 0.53%

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

EPSS 1.39%

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

EPSS 1.39%

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

EPSS 1.57%

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

EPSS 1.57%

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

EPSS 0.47%

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

EPSS 0.47%

SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

EPSS 0.32%

SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

EPSS 0.32%

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

EPSS 0.41%

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

EPSS 0.41%

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

EPSS 0.24%

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

EPSS 0.24%

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

EPSS 0.53%

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

EPSS 0.53%

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

EPSS 0.34%

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

EPSS 0.34%

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

EPSS 0.59%

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

EPSS 0.59%

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

EPSS 0.48%

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

EPSS 0.48%

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

EPSS 0.46%

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

EPSS 0.46%

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

EPSS 0.36%

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

EPSS 0.36%

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

EPSS 0.30%

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

EPSS 0.30%

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

EPSS 7.47%

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

EPSS 7.47%

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

EPSS 4.32%

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

EPSS 4.32%

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

EPSS 0.38%

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

EPSS 0.38%

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

EPSS 2.17%

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

EPSS 2.17%

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

EPSS 0.56%

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

EPSS 0.56%

Duplicate Advisory: SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

EPSS 0.32%

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

EPSS 0.32%

SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

EPSS 0.21%

SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

EPSS 0.21%

SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode

EPSS 0.22%

SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode

EPSS 0.22%

SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

EPSS 0.15%

SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

EPSS 0.15%

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

EPSS 0.51%

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

EPSS 0.51%

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

EPSS 0.51%

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

EPSS 0.51%

SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)

EPSS 0.37%

SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)

EPSS 0.37%

SiYuan has incomplete fix for CVE-2026-33066: XSS

EPSS 0.26%

SiYuan has incomplete fix for CVE-2026-33066: XSS

EPSS 0.26%

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

EPSS 0.29%

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

EPSS 0.29%

SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView`

EPSS 0.40%

SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView`

EPSS 0.40%

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

EPSS 0.31%

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

EPSS 0.31%

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

EPSS 0.54%

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

EPSS 0.54%

SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated)

EPSS 0.47%

SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated)

EPSS 0.47%

SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution

EPSS 0.35%

SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution

EPSS 0.35%

SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark

EPSS 1.23%

SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark

EPSS 1.23%

SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

EPSS 0.51%

SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

EPSS 0.51%

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

EPSS 0.50%

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

EPSS 0.50%

SiYuan has directory traversal within its publishing service

EPSS 0.67%

SiYuan has directory traversal within its publishing service

EPSS 0.67%

SiYuan has Arbitrary Document Reading within the Publishing Service

EPSS 0.53%

SiYuan has Arbitrary Document Reading within the Publishing Service

EPSS 0.53%

SiYuan has Arbitrary Document Reading within the Publishing Service

EPSS 0.53%

Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal

EPSS 3.26%

Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal

EPSS 3.26%

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

EPSS 0.52%

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

EPSS 0.52%

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)

EPSS 0.51%

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)

EPSS 0.51%

SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

EPSS 0.56%

SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

EPSS 0.56%

SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

EPSS 0.60%

SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

EPSS 0.60%

SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service

EPSS 0.42%

SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service

EPSS 0.42%

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

EPSS 0.55%

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

EPSS 0.55%

SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

EPSS 0.50%

SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

EPSS 0.50%

SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

EPSS 0.83%

SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

EPSS 0.83%

SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write

EPSS 0.44%

SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write

EPSS 0.44%

SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

EPSS 0.38%

SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

EPSS 0.38%

SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets

EPSS 0.43%

SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets

EPSS 0.43%

SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB

EPSS 0.26%

SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB

EPSS 0.26%

SiYuan has a Full-Read SSRF via /api/network/forwardProxy

EPSS 0.35%

SiYuan has a Full-Read SSRF via /api/network/forwardProxy

EPSS 0.35%

SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

EPSS 0.52%

SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

EPSS 0.52%

SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

EPSS 0.46%

SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

EPSS 0.46%

SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren

EPSS 0.32%

SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren

EPSS 0.32%

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

EPSS 1.11%

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

EPSS 1.11%

SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint

EPSS 0.64%

SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint

EPSS 0.64%

SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access

EPSS 0.34%

SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access

EPSS 0.34%

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

EPSS 1.10%

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

EPSS 1.10%

SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal

EPSS 0.59%

SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal

EPSS 0.59%

SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

EPSS 0.52%

SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

EPSS 0.52%

SiYuan vulnerable to Arbitrary file Read / SSRF

EPSS 0.62%

SiYuan vulnerable to Arbitrary file Read / SSRF

EPSS 0.62%

SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

EPSS 0.31%

SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

EPSS 0.31%

SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload

EPSS 0.28%

SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload

EPSS 0.28%

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

EPSS 0.44%

SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

EPSS 0.44%

SiYuan has an arbitrary file deletion vulnerability

EPSS 0.63%

SiYuan has an arbitrary file deletion vulnerability

EPSS 0.63%

SiYuan has an arbitrary file read via /api/template/render

EPSS 0.74%

SiYuan has an arbitrary file read via /api/template/render

EPSS 0.74%

SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

EPSS 0.60%

SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

EPSS 0.60%

SiYuan has an arbitrary file write in the host via /api/asset/upload

EPSS 0.38%

SiYuan has an arbitrary file write in the host via /api/asset/upload

EPSS 0.38%

SiYuan has an SSTI via /api/template/renderSprig

EPSS 0.62%

SiYuan has an SSTI via /api/template/renderSprig

EPSS 0.62%