Vulnerabilities

Filters

2 selected

55 records

Sort

Vendor: siyuan-note Component: Siyuan Clear all filters

TI-2026-29576 CVE-2026-40922 · GHSA-8q5w-mmxf-48jg

SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)

MEDIUM 57

SiYuan is an open-source personal knowledge management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00261 Published 2026-04-16 Fixed in 3.6.4, 0.0.0-20260414013942-62eed37a3263 CWE-79

TI-2026-29099 CVE-2026-40322

SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

HIGH 74

SiYuan is an open-source personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00306 Published 2026-04-16 Fixed in 3.6.4 CWE-79

TI-2026-29095 CVE-2026-40318 · GHSA-vw86-c94w-v3x4

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

LOW 37

SiYuan is an open-source personal knowledge management system.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00287 Published 2026-04-16 Fixed in 3.6.4, 3.6.40.0.0-20260407035653-2f416e5253f1 CWE-24

TI-2026-29053 CVE-2026-40259 · GHSA-7m5h-w69j-qggg

SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API

HIGH 68

SiYuan is an open-source personal knowledge management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.004 Published 2026-04-16 Fixed in 0.0.0-20260407035653-2f416e5253f1, 3.6.4 CWE-285

TI-2026-28933 CVE-2026-40107 · GHSA-w95v-4h65-j455

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

HIGH 71

SiYuan is a personal knowledge management system.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00318 Published 2026-04-09 Fixed in 3.6.4, 0.0.0-20260407035653-2f416e5253f1 CWE-918

TI-2026-28728 CVE-2026-39846 · GHSA-phhp-9rm9-6gr2

SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

HIGH 74

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00559 Published 2026-04-07 Fixed in 3.6.4, 0.0.0-20260407035653-2f416e5253f1 CWE-79

TI-2026-26852 CVE-2026-34605 · GHSA-73g7-86qr-jrg3

SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00469 Published 2026-03-31 Fixed in 3.6.2, 0.0.0-20260330031106-f09953afc57a CWE-79

TI-2026-26832 CVE-2026-34585 · GHSA-ff66-236v-p4fg

SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00349 Published 2026-03-31 Fixed in 3.6.2, 0.0.0-20260329142331-918d1bd9f967 CWE-79

TI-2026-26714 CVE-2026-34449 · GHSA-68p4-j234-43mv

SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

HIGH 76

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00508 Published 2026-03-31 Fixed in 3.6.2 CWE-942

TI-2026-26713 CVE-2026-34448 · GHSA-rx4h-526q-4458

Cross-site scripting in siyuan-note siyuan

HIGH 74

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00498 Published 2026-03-31 Fixed in 3.6.2 CWE-79

TI-2026-26718 CVE-2026-34453 · GHSA-c77m-r996-jr3q

Incorrect authorization in siyuan-note siyuan

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01227 Published 2026-03-31 Fixed in 3.6.2 CWE-863

TI-2026-26050 CVE-2026-33670 · GHSA-xmw9-6r43-x9ww

SiYuan has directory traversal within its publishing service

HIGH 82

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00672 Published 2026-03-26 Fixed in 3.6.2 CWE-22

TI-2026-26049 CVE-2026-33669 · GHSA-34xj-66v3-6j83

SiYuan has Arbitrary Document Reading within the Publishing Service

HIGH 76

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00532 Published 2026-03-26 Fixed in 3.6.2 CWE-125

TI-2026-25872 CVE-2026-33476 · GHSA-hhgj-gg9h-rjp7

SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03328 Published 2026-03-20 Fixed in 3.6.2 CWE-22

TI-2026-25624 CVE-2026-33203 · GHSA-3g9h-9hp4-654v

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00528 Published 2026-03-20 Fixed in 3.6.2 CWE-248

TI-2026-25619 CVE-2026-33194 · GHSA-vm69-h85x-8p85

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home

MEDIUM 63

SiYuan is a personal knowledge management system.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00519 Published 2026-03-20 Fixed in 3.6.2 CWE-22

TI-2026-25509 CVE-2026-33067 · GHSA-mvpm-v6q4-m2pf

SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

MEDIUM 57

SiYuan is a personal knowledge management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00572 Published 2026-03-20 Fixed in 3.6.1, 0.0.0-20260317012524-fe4523fff2c8 CWE-79

TI-2026-25508 CVE-2026-33066 · GHSA-4663-4mpg-879v

SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

MEDIUM 57

SiYuan is a personal knowledge management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00608 Published 2026-03-20 Fixed in 3.6.1, 0.0.0-20260314111550-b382f50e1880 CWE-79

TI-2026-25388 CVE-2026-32940 · GHSA-4mx9-3c2h-hwhg

SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)

HIGH 73

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00315 Published 2026-03-20 Fixed in 3.6.1 CWE-184

TI-2026-25386 CVE-2026-32938 · GHSA-fq2j-j8hc-8vw8

SiYuan has an Arbitrary File Read in its Desktop Publish Service

HIGH 76

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0043 Published 2026-03-20 Fixed in 3.6.1 CWE-200

TI-2026-25256 CVE-2026-32767 · GHSA-j7wh-x834-p3r7

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

HIGH 82

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00563 Published 2026-03-20 Fixed in 3.6.1 CWE-863

TI-2026-25284 CVE-2026-32815 · GHSA-xp2m-98x8-rpj6

SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

MEDIUM 57

SiYuan is a personal knowledge management system.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00383 Published 2026-03-19 Fixed in 3.6.1 CWE-287

TI-2026-25241 CVE-2026-32750 · GHSA-rjhh-m223-9qqv

SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes

MEDIUM 63

SiYuan is a personal knowledge management system.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00458 Published 2026-03-19 Fixed in 3.6.1 CWE-22

TI-2026-25242 CVE-2026-32751 · GHSA-qr46-rcv3-4hq3

SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

MEDIUM 58

SiYuan is a personal knowledge management system.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00845 Published 2026-03-19 Fixed in 3.6.1 CWE-79

TI-2026-25240 CVE-2026-32749 · GHSA-qvvf-q994-x79v

SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

HIGH 72

SiYuan is a personal knowledge management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00452 Published 2026-03-19 Fixed in 3.6.1 CWE-22