Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: siyuan-note siyuan 3.8.7 Clear all filters
TI-2026-80189 CVE-2026-116171 · GHSA-6xx3-j82h-hmgh

Path denylist bypass in SiYuan on Windows exposes workspace secrets

Priority LOW 33

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00479 Published 2026-10-25 Fixed in 3.8.7 CWE-22
TI-2026-80188 CVE-2026-116170 · GHSA-hf8g-c9wm-2xp9

SQL injection in SiYuan history search exposes history.db

Priority MEDIUM 64

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00361 Published 2026-10-25 Fixed in 3.8.7 CWE-89
TI-2026-80187 CVE-2026-116169 · GHSA-mqcm-q7hm-v37p

SiYuan Stored XSS via KaTeX \href in Math Blocks

Priority MEDIUM 56

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust ena…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00205 Published 2026-10-25 Fixed in 3.8.7 CWE-79
TI-2026-80186 CVE-2026-116168 · GHSA-659w-8mpv-qcqc

Path traversal in SiYuan MCP asset tool lets attackers read local files

Priority MEDIUM 64

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00186 Published 2026-10-25 Fixed in 3.8.7 CWE-22
TI-2026-80185 CVE-2026-116167 · GHSA-jvrf-pm5c-jgr4

Cross-site scripting in SiYuan via check-auth to parameter

Priority LOW 36

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00656 Published 2026-10-25 Fixed in 3.8.7 CWE-79
TI-2026-80184 CVE-2026-116166 · GHSA-89mj-v839-4h76

Cleartext transmission in SiYuan exposes login and session cookies

Priority HIGH 68

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS.

CVSS 4.0HIGH 7.6 Adjacent network No auth No interaction EPSS 0.00115 Published 2026-10-25 Fixed in 3.8.7 CWE-319