PatchTheCVE: b3log

CVE-2026-40922: SiYuan is an open-source personal knowledge management system

Wed, 17 Jun 2026 10:45:53 +0000

MEDIUM 5.4: SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effe

CVE-2026-40322: SiYuan is an open-source personal knowledge management system

Wed, 17 Jun 2026 10:45:01 +0000

CRITICAL 9.0: SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendered with securityLevel set to "loose", and the resulting SVG is injected into the DOM via innerHTML. This allows attacker-controlled javascript: URLs in Mermaid code blocks to surviv

CVE-2026-40318: SiYuan is an open-source personal knowledge management system

Wed, 17 Jun 2026 10:45:01 +0000

HIGH 8.5: SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequen

CVE-2026-40259: SiYuan is an open-source personal knowledge management system

Wed, 17 Jun 2026 10:44:55 +0000

HIGH 8.1: SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttributeView endpoint is protected only by generic authentication that accepts publish-service RoleReader tokens. The handler passes a caller-controlled id directly to a model functio

CVE-2026-40107: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:44:44 +0000

MEDIUM 6.5: SiYuan is a personal knowledge management system. Prior to 3.6.4, SiYuan configures Mermaid.js with securityLevel: "loose" and htmlLabels: true. In this mode, tags with src attributes survive Mermaid's internal DOMPurify and land in SVG blocks. The SVG is injected via innerHTML

CVE-2026-39846: SiYuan is a personal knowledge management system

Mon, 20 Jul 2026 20:10:00 +0000

CRITICAL 9.0: SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, crea

CVE-2026-33670: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:37:53 +0000

CRITICAL 9.8: SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

CVE-2026-33669: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:37:53 +0000

CRITICAL 9.8: SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue.

CVE-2026-33476: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:37:33 +0000

HIGH 7.5: SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server p

CVE-2026-33203: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:37:06 +0000

HIGH 7.5: SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on attacker-con

CVE-2026-33194: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:37:06 +0000

MEDIUM 6.8: SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not b

CVE-2026-33067: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:53 +0000

CRITICAL 9.0: SiYuan is a personal knowledge management system. Versions 3.6.0 and below render package metadata fields (displayName, description) using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fields, which executes automatically when any

CVE-2026-33066: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:53 +0000

CRITICAL 9.0: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New() without calling SetSanitize(true), allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to innerHTML without any

CVE-2026-32940: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:36 +0000

CRITICAL 9.3: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and data:image/svg+xml in href attributes but misses data:text/xml and data:application/xml, both of which can render SVG with JavaScript execution. The u

CVE-2026-32938: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:35 +0000

CRITICAL 9.9: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Together with GET /asset

CVE-2026-32767: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:20 +0000

CRITICAL 9.8: SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlying S

CVE-2026-32815: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:23 +0000

HIGH 7.5: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connections when specific URL parameters are provided (?app=siyuan&id=auth&type=auth). This bypass, intended for the login page to keep the kernel alive, allows any exte

CVE-2026-32751: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:19 +0000

CRITICAL 9.0: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version (Files.ts) properly uses escapeHtml() for the same oper

CVE-2026-32750: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:19 +0000

MEDIUM 6.8: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation. The function recursively reads every file under the given path and permanently stores their cont

CVE-2026-32749: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:19 +0000

HIGH 7.6: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside

CVE-2026-32747: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:18 +0000

MEDIUM 6.8: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the globalCopyFiles API eads source files using filepath.Abs() with no workspace boundary check, relying solely on util.IsSensitivePath() whose blocklist omits /proc/, /run/secrets/, and home directory dotfiles. An admin

CVE-2026-32704: SiYuan is a personal knowledge management system

Wed, 17 Jun 2026 10:36:14 +0000

MEDIUM 6.5: SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. This v