siyuan-note

Records243All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical67CVSS 9.0–10.0

CVSS high89CVSS 7.0–8.9

Exploited now

siyuan-note records in CISA KEV

No siyuan-note vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Siyuan 55 records HIGH Symphony 6 records HIGH Vditor 6 records MEDIUM Solo 2 records LOW Wide 1 record LOW

Records

55 records in Siyuan · all components

TI-2026-26050 CVE-2026-33670 · GHSA-xmw9-6r43-x9ww

SiYuan has directory traversal within its publishing service

HIGH 82

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00672 Published 2026-03-26 Fixed in 3.6.2 CWE-22

TI-2026-25256 CVE-2026-32767 · GHSA-j7wh-x834-p3r7

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

HIGH 82

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00563 Published 2026-03-20 Fixed in 3.6.1 CWE-863

TI-2024-35827 CVE-2024-53507 · GHSA-j4r5-m4h2-m93g

A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.

HIGH 82

A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00567 Published 2024-11-29 No fix listed CWE-89

TI-2024-35826 CVE-2024-53506 · GHSA-w5f2-gvhw-r7q6

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.

HIGH 82

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00537 Published 2024-11-29 No fix listed CWE-89

TI-2024-35825 CVE-2024-53505 · GHSA-xjm8-v6p6-5c3j

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.

HIGH 82

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00509 Published 2024-11-29 No fix listed CWE-89

TI-2024-35824 CVE-2024-53504 · GHSA-rhx4-chf7-v77c

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.

HIGH 82

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00567 Published 2024-11-29 No fix listed CWE-89

TI-2026-23698 CVE-2026-30869 · GHSA-2h2p-mvfx-868w

SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

HIGH 81

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01191 Published 2026-03-09 Fixed in 3.5.10 CWE-22

TI-2026-26714 CVE-2026-34449 · GHSA-68p4-j234-43mv

SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

HIGH 76

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00508 Published 2026-03-31 Fixed in 3.6.2 CWE-942

TI-2026-26049 CVE-2026-33669 · GHSA-34xj-66v3-6j83

SiYuan has Arbitrary Document Reading within the Publishing Service

HIGH 76

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00532 Published 2026-03-26 Fixed in 3.6.2 CWE-125

TI-2026-25386 CVE-2026-32938 · GHSA-fq2j-j8hc-8vw8

SiYuan has an Arbitrary File Read in its Desktop Publish Service

HIGH 76

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0043 Published 2026-03-20 Fixed in 3.6.1 CWE-200

TI-2026-29099 CVE-2026-40322

SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

HIGH 74

SiYuan is an open-source personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00306 Published 2026-04-16 Fixed in 3.6.4 CWE-79

TI-2026-28728 CVE-2026-39846 · GHSA-phhp-9rm9-6gr2

SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

HIGH 74

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00559 Published 2026-04-07 Fixed in 3.6.4, 0.0.0-20260407035653-2f416e5253f1 CWE-79

TI-2026-26713 CVE-2026-34448 · GHSA-rx4h-526q-4458

Cross-site scripting in siyuan-note siyuan

HIGH 74

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00498 Published 2026-03-31 Fixed in 3.6.2 CWE-79

TI-2026-20648 CVE-2026-25539 · GHSA-c4jr-5q7w-f6r9

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

HIGH 74

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01105 Published 2026-02-04 Fixed in 3.5.5 CWE-22

TI-2024-02507 CVE-2024-2692 · GHSA-pgf5-9895-3ph9

SiYuan 3.0.3 - RCE via Server Side XSS

HIGH 74

SiYuan version 3.0.3 allows executing arbitrary commands on the server.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0073 Published 2024-04-04 No fix listed CWE-79

TI-2026-25388 CVE-2026-32940 · GHSA-4mx9-3c2h-hwhg

SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)

HIGH 73

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00315 Published 2026-03-20 Fixed in 3.6.1 CWE-184

TI-2026-26852 CVE-2026-34605 · GHSA-73g7-86qr-jrg3

SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00469 Published 2026-03-31 Fixed in 3.6.2, 0.0.0-20260330031106-f09953afc57a CWE-79

TI-2026-26832 CVE-2026-34585 · GHSA-ff66-236v-p4fg

SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00349 Published 2026-03-31 Fixed in 3.6.2, 0.0.0-20260329142331-918d1bd9f967 CWE-79

TI-2026-26718 CVE-2026-34453 · GHSA-c77m-r996-jr3q

Incorrect authorization in siyuan-note siyuan

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01227 Published 2026-03-31 Fixed in 3.6.2 CWE-863

TI-2026-25872 CVE-2026-33476 · GHSA-hhgj-gg9h-rjp7

SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03328 Published 2026-03-20 Fixed in 3.6.2 CWE-22

TI-2026-25624 CVE-2026-33203 · GHSA-3g9h-9hp4-654v

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00528 Published 2026-03-20 Fixed in 3.6.2 CWE-248

TI-2026-25240 CVE-2026-32749 · GHSA-qvvf-q994-x79v

SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00452 Published 2026-03-19 Fixed in 3.6.1 CWE-22

TI-2026-21007 CVE-2026-25992 · GHSA-f72r-2h5j-7639

SiYuan has a File Read Interface Case Bypass Vulnerability

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00601 Published 2026-02-10 Fixed in 3.5.5 CWE-22

TI-2026-28933 CVE-2026-40107 · GHSA-w95v-4h65-j455

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

HIGH 71

SiYuan is a personal knowledge management system.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00318 Published 2026-04-09 Fixed in 3.6.4, 0.0.0-20260407035653-2f416e5253f1 CWE-918

TI-2026-24648 CVE-2026-32110 · GHSA-56cv-c5p2-j2wg

SiYuan has a Full-Read SSRF via /api/network/forwardProxy

HIGH 71

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00376 Published 2026-03-11 Fixed in 3.6.0 CWE-918

Open these records in search →