Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: siyuan-note siyuan 3.8.0 Clear all filters
TI-2026-42813 CVE-2026-60083 · GHSA-c8r8-95hg-mp34 · GHSA-rp7c-4prv-9rrg

SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

Priority LOW 31

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00391 Published 2026-08-22 Fixed in 3.8.0, 0.0.0-20260808051406-3542530c505f CWE-863
TI-2026-42630 CVE-2026-59809 · GHSA-27jw-6xjf-hgxj

SiYuan before v3.8.0 Secret Exfiltration via http_request URL

Priority LOW 31

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00413 Published 2026-08-22 Fixed in 3.8.0 CWE-201