SiYuan vulnerabilities
CVEs whose affected-version data names the SiYuan package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
66 CVEsRSS
CVE-2026-56397Critical· 9.6PoCSiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user bro…
CVE-2026-34453High· 7.5PoCSiYuan is a personal knowledge management system
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark f…
CVE-2026-34449Critical· 9.6SiYuan is a personal knowledge management system
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * …
CVE-2026-34448Critical· 9.0SiYuan is a personal knowledge management system
SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -…
CVE-2025-68948High· 8.1SiYuan is self-hosted, open source personal knowledge management software
SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session…
CVE-2025-67488High· 7.8SiYuan is self-hosted, open source personal knowledge management software
SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite fil…