GHSA-x8p6-569w-fmmrLow· 8.2▾ SunlitDuplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
▾ Sunlit zone — Low / medium · no exploitation signal
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-3cc2-h3v6-rqpq. This link is maintained to preserve external references.
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.
github.com/siyuan-note/siyuan/kernel < 0.0.0-20260803045322-cb67e0b4fab5Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74802Low· 0.0SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` by…
CVE-2026-54069CriticalSiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
GHSA-hg5w-8ppq-wpjqHigh· 7.5Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6
GHSA-989h-w3q9-3m2fMedium· 6.6Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
GHSA-6xvp-3rfv-g2g2Medium· 5.8Duplicate Advisory: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
GHSA-xp3q-r38w-vgqmMedium· 5.8SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized