siyuan-note has 155 CVEs on record. Disclosure cadence is accelerating: 131 in the last 90 days against 18 in the 90 before. The busiest recent month was September 2026 with 71. The median CVSS is 7.3 (high), with 20 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (37) and CWE-79 (29). Most affected products: github.com/siyuan-note/siyuan/kernel (94), siyuan (60), github.com/siyuan-note/siyuan (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 131 prev 18
Weakness classes
Products
- github.com/siyuan-note/siyuan/kernel 94
- siyuan 60
- github.com/siyuan-note/siyuan 1
Worst active — by depth score
CVE-2026-69085Critical· 10.0SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking67CVE-2026-69084Critical· 10.0SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write67CVE-2026-69083Critical· 10.0SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB67CVE-2026-66012Critical· 10.0SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement67CVE-2026-54069CriticalSiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist66
siyuan-note vulnerabilities
CVEs affecting siyuan-note, newest first. Open any entry for full detail, references, and exploit status.
155 CVEsRSS
CVE-2026-33194Medium· 6.8SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
CVE-2026-33066MediumSiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
CVE-2026-32704Medium· 6.5SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB
SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB
CVE-2026-32110High· 8.3SiYuan has a Full-Read SSRF via /api/network/forwardProxy
SiYuan has a Full-Read SSRF via /api/network/forwardProxy
CVE-2026-30869Critical· 9.3SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage