{"schema_version":"1","data":[{"id":20590,"advisory_id":"8e5c135a-68e9-4690-afac-73c1d9e32064","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109310","source_published_at":"2026-10-12T16:05:06.076+00:00","published_at":"2026-10-25T05:31:07.584952+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-109310"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template","summary":"SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.","evidence":"cve:CVE-2026-109310","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109310","aliases":["CVE-2026-109310"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"3.1.12","lessThan":"3.8.6","versionType":"semver"},{"status":"unaffected","version":"3.8.6","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-13T18:10:38.950Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cxwr-r7cq-xw52","https://www.vulncheck.com/advisories/siyuan-3.1.12-before-3.8.6-denial-of-service-via-getdynamicicon-template"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109310","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T18:10:14.106821Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cxwr-r7cq-xw52","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T18:10:38.950Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T16:05:06.076Z"}}},"related_cves":[{"value":"CVE-2026-109310","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":20483,"advisory_id":"8c468935-4229-46c1-bc1a-2542dfe25449","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109309","source_published_at":"2026-10-12T16:05:05.359+00:00","published_at":"2026-10-25T05:29:10.212728+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-109309"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path","summary":"SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.","evidence":"cve:CVE-2026-109309","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109309","aliases":["CVE-2026-109309"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"3.7.0","lessThan":"3.8.6","versionType":"semver"},{"status":"unaffected","version":"3.8.6","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-13T16:54:55.029Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-phmw-4rgv-r4xv","https://github.com/siyuan-note/siyuan/commit/c6494375ea40ee973f430f0e85d50f1862a30d81","https://www.vulncheck.com/advisories/siyuan-3.7.0-before-3.8.6-arbitrary-file-read-via-plugin-responsefile-path"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109309","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T16:22:11.778095Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T16:54:55.029Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T16:05:05.359Z"}}},"related_cves":[{"value":"CVE-2026-109309","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":13009,"advisory_id":"b9a73050-c6d6-4efe-975d-f5c1b2ff7e96","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87807","source_published_at":"2026-09-09T11:20:56.932+00:00","published_at":"2026-10-25T00:17:28.960615+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-87807"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"siyuan before v3.8.2 SQL Injection via fullTextSearchBlock","summary":"siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and sensitive attributes.","evidence":"cve:CVE-2026-87807","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-87807","aliases":["CVE-2026-87807"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.2","versionType":"semver"},{"status":"unaffected","version":"3.8.2","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:49.895Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-336w-67gx-gx2h","https://www.vulncheck.com/advisories/siyuan-before-3.8.2-sql-injection-via-fulltextsearchblock"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87807","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-10T14:22:32.089191Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-10T14:58:46.930Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:49.895Z"}}},"related_cves":[{"value":"CVE-2026-87807","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":13004,"advisory_id":"36b83de7-4333-45e1-be84-563e0652563b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85578","source_published_at":"2026-09-04T11:29:48.193+00:00","published_at":"2026-10-25T00:17:25.916442+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-85578"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan through 3.8.1 Authorization Bypass via getFile","summary":"SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.","evidence":"cve:CVE-2026-85578","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85578","aliases":["CVE-2026-85578"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"3.8.1"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:47.056Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8ggq-wq3f-vxrw","https://www.vulncheck.com/advisories/siyuan-through-3.8.1-authorization-bypass-via-getfile"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85578","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-14T13:24:18.499565Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-14T13:50:50.532Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:47.056Z"}}},"related_cves":[{"value":"CVE-2026-85578","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":13000,"advisory_id":"574f3e30-118f-468d-a1b5-af7edc096726","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75917","source_published_at":"2026-08-19T14:01:51.076+00:00","published_at":"2026-10-25T00:17:23.647993+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-75917"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.7.4 XSS-to-RCE via pathName.ts","summary":"SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by the 'move/link to' path-selection dialogs, where document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated into the aria-label HTML attribute without escaping. A document crafted with a double quote in any of these fields breaks out of the attribute context and injects arbitrary HTML attributes including inline event handlers (e.g., onmouseover). Because every SiYuan Electron BrowserWindow runs with nodeIntegration:true, contextIsolation:false, and no CSP, the injected handler gains require('child_process') access, escalating the XSS to arbitrary OS command execution when a victim merely hovers over the malicious document entry in the path-picker dialog. Malicious documents reach victims via sharing, sync, or import.","evidence":"cve:CVE-2026-75917","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-75917","aliases":["CVE-2026-75917"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"LOCAL","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.7.4","versionType":"semver"},{"status":"unaffected","version":"3.7.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:44.250Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jjq3-3942-x99r","https://www.vulncheck.com/advisories/siyuan-before-xss-to-rce-via-pathname-ts"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-75917","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-20T17:23:02.035728Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jjq3-3942-x99r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T17:23:11.359Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:44.250Z"}}},"related_cves":[{"value":"CVE-2026-75917","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12999,"advisory_id":"a861dc63-48a9-4c31-a563-d0a8742bc93e","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75916","source_published_at":"2026-08-19T14:01:50.37+00:00","published_at":"2026-10-25T00:17:22.902521+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-75916"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan XSS-to-RCE via unescaped block metadata in hint popup","summary":"SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. ) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('child_process') access, allowing the XSS to escalate to arbitrary OS command execution.","evidence":"cve:CVE-2026-75916","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-75916","aliases":["CVE-2026-75916"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"LOCAL","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"affected"}],"modified":"2026-10-08T15:51:43.765Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5prr-vgxq-69g9","https://www.vulncheck.com/advisories/siyuan-xss-to-rce-via-unescaped-block-metadata-in-hint-popup"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-75916","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-21T19:21:47.693296Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5prr-vgxq-69g9","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-21T19:22:16.263Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:43.765Z"}}},"related_cves":[{"value":"CVE-2026-75916","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12997,"advisory_id":"887ba502-23cc-46ba-8a51-1b1ce7a4889b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74902","source_published_at":"2026-08-18T11:19:34.741+00:00","published_at":"2026-10-25T00:17:21.627984+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-74902"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload","summary":"SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.","evidence":"cve:CVE-2026-74902","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-74902","aliases":["CVE-2026-74902"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"LOCAL","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.7.4","versionType":"semver"},{"status":"unaffected","version":"3.7.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:41.982Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jf56-jrhq-j2qp","https://www.vulncheck.com/advisories/siyuan-before-xss-to-rce-via-malicious-filename-upload"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74902","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-18T12:52:00.846926Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-18T13:36:31.175Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:41.982Z"}}},"related_cves":[{"value":"CVE-2026-74902","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12977,"advisory_id":"61efd660-8453-4824-85e8-5e08eea9d5e4","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100644","source_published_at":"2026-09-26T13:23:16.086+00:00","published_at":"2026-10-25T00:16:27.909764+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100644"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath","summary":"SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.","evidence":"cve:CVE-2026-100644","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100644","aliases":["CVE-2026-100644"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:26.948Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-dailynotesavepath"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100644","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:38:36.495700Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:39:01.215Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:26.948Z"}}},"related_cves":[{"value":"CVE-2026-100644","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12976,"advisory_id":"7b553f94-8aa0-40a7-8b69-edce8154dba4","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100645","source_published_at":"2026-09-26T13:23:16.77+00:00","published_at":"2026-10-25T00:16:27.325671+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100645"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban","summary":"SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges.","evidence":"cve:CVE-2026-100645","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100645","aliases":["CVE-2026-100645"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"3.7.0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:27.580Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-556j-q8c8-qqg3","https://www.vulncheck.com/advisories/siyuan-3.7.0-before-3.8.4-stored-xss-via-gallery-kanban"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100645","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T17:55:16.020546Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-556j-q8c8-qqg3","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T17:55:24.967Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:27.580Z"}}},"related_cves":[{"value":"CVE-2026-100645","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12975,"advisory_id":"7bfa4e99-e8e3-420e-ac6f-fdaa037cb0a1","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100634","source_published_at":"2026-09-26T13:23:09.166+00:00","published_at":"2026-10-25T00:16:26.766443+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100634"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows","summary":"SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: \"lockscreenByMode\"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.","evidence":"cve:CVE-2026-100634","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100634","aliases":["CVE-2026-100634"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":4.7,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:25.360Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wxp7-xpq8-8xpm","https://github.com/siyuan-note/siyuan/commit/8641553a1f07374001902d3ce773285db1292b2d","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-missing-authorization-via-siyuan-send-windows"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100634","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T13:01:06.934595Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wxp7-xpq8-8xpm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T13:01:30.819Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:25.360Z"}}},"related_cves":[{"value":"CVE-2026-100634","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12799,"advisory_id":"6838d8de-ee40-41cb-b720-d7db36d9ac3d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-66394","source_published_at":"2026-07-27T15:43:45.397+00:00","published_at":"2026-10-25T00:13:50.862237+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-66394"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass","summary":"SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.","evidence":"cve:CVE-2026-66394","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-66394","aliases":["CVE-2026-66394"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.7.3","versionType":"semver"},{"status":"unaffected","version":"3.7.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:24:01.023Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-99rq-75j6-5j9f","https://www.vulncheck.com/advisories/siyuan-before-stored-and-reflected-xss-via-svg-sanitizer-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-66394","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-07-27T17:58:40.465603Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-99rq-75j6-5j9f","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-27T17:58:47.419Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:24:01.023Z"}}},"related_cves":[{"value":"CVE-2026-66394","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12795,"advisory_id":"dc6dbb34-c791-428d-9e2b-3acf67ae6f6d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-65607","source_published_at":"2026-07-23T11:42:14.89+00:00","published_at":"2026-10-25T00:13:48.45198+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-65607"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.7.2 Path Traversal via /export/temp/","summary":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.","evidence":"cve:CVE-2026-65607","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-65607","aliases":["CVE-2026-65607"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.7.2","versionType":"semver"},{"status":"unaffected","version":"3.7.2","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:23:57.946Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88","https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7","https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-export-temp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-65607","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-07-27T16:13:34.297770Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-27T16:20:57.610Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:23:57.946Z"}}},"related_cves":[{"value":"CVE-2026-65607","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12760,"advisory_id":"dde0a3e2-fe8e-474b-9ce3-30f2952609aa","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-56397","source_published_at":"2026-06-21T13:27:04.512+00:00","published_at":"2026-10-25T00:13:23.834853+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-56397"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README","summary":"SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.","evidence":"cve:CVE-2026-56397","products":[{"name":{"value":"SiYuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-56397","aliases":["CVE-2026-56397"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.6,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"SiYuan","product":"SiYuan","versions":[{"status":"affected","version":"0","lessThan":"3.6.1","versionType":"semver"},{"status":"unaffected","version":"3.6.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:23:24.603Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7","https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-56397","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-06-24T15:35:29.612043Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-24T15:35:50.419Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:23:24.603Z"}}},"related_cves":[{"value":"CVE-2026-56397","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12669,"advisory_id":"3c0eb457-3120-4eca-bb01-fce851f8ff1f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100640","source_published_at":"2026-09-26T13:23:13.287+00:00","published_at":"2026-10-25T00:11:47.870119+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100640"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Clipboard Data Disclosure via IPC","summary":"SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations.","evidence":"cve:CVE-2026-100640","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100640","aliases":["CVE-2026-100640"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.6,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":4.7,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:21:52.521Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mjmm-hgmc-m7qf","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-clipboard-data-disclosure-via-ipc"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100640","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:52:05.500068Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mjmm-hgmc-m7qf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:52:26.290Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:21:52.521Z"}}},"related_cves":[{"value":"CVE-2026-100640","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12667,"advisory_id":"c360a35c-477e-4b47-83a5-8b78d8902866","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100635","source_published_at":"2026-09-26T13:23:09.854+00:00","published_at":"2026-10-25T00:11:46.488606+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100635"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie","summary":"SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.","evidence":"cve:CVE-2026-100635","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100635","aliases":["CVE-2026-100635"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:21:51.712Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m","https://github.com/siyuan-note/siyuan/commit/79d47867b106467c951475a9193455b48d1f3682","https://github.com/siyuan-note/siyuan/commit/ff4d215f78a8d6e6db6052be18b5f9f4db9c7d68","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-authentication-bypass-via-plaintext-session-cookie"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100635","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:53:29.876873Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:54:06.101Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:21:51.712Z"}}},"related_cves":[{"value":"CVE-2026-100635","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":8983,"advisory_id":"487b6f2b-3edf-4cc8-a2dc-0a6139c8b774","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103762","source_published_at":"2026-10-02T11:37:53.531+00:00","published_at":"2026-10-24T23:10:09.396002+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-103762"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints","summary":"SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.","evidence":"cve:CVE-2026-103762","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-103762","aliases":["CVE-2026-103762"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.5","versionType":"semver"},{"status":"unaffected","version":"3.8.5","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-06T02:33:19.013Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mrf-mx66-vv6g","https://www.vulncheck.com/advisories/siyuan-before-3.8.5-missing-authorization-in-save-path-resolver-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103762","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T02:32:53.413599Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mrf-mx66-vv6g","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T02:33:19.013Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:37:53.531Z"}}},"related_cves":[{"value":"CVE-2026-103762","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":8763,"advisory_id":"d86a92a5-ce65-4c5e-b288-41c9a3bfb0b0","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100641","source_published_at":"2026-09-26T13:23:13.957+00:00","published_at":"2026-10-24T23:05:55.980607+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100641"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content","summary":"SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content such as becomes an executable event-handler attribute. Because the SiYuan desktop (Electron) main window is created with nodeIntegration enabled and contextIsolation disabled, an administrator who opens the card manager on a workspace containing attacker-supplied flashcard content (for example introduced through contribution or import) executes the attacker's script in a privileged renderer, which can lead to arbitrary code execution on the host. The affected endpoint remains behind authentication and administrator-role checks; this is an untrusted-content-to-privileged-renderer issue, not an authorization bypass.","evidence":"cve:CVE-2026-100641","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100641","aliases":["CVE-2026-100641"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-05T15:58:59.286Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mmf-4xwm-55rm","https://github.com/siyuan-note/siyuan/commit/1ecb1c07de497ff03b585536fe5579291754d96b","https://github.com/siyuan-note/siyuan/commit/48c354e7de130aaada9d7120125bbc768344fd3b","https://github.com/siyuan-note/siyuan/commit/41b14025b4ac4a8379d1200580344ca18ad152b7","https://github.com/siyuan-note/siyuan/commit/8641553a1f07374001902d3ce773285db1292b2d","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-unescaped-flashcard-content"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100641","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-05T15:58:53.239401Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mmf-4xwm-55rm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T15:58:59.286Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:13.957Z"}}},"related_cves":[{"value":"CVE-2026-100641","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":8689,"advisory_id":"2b14aa48-6748-4791-b029-c347a5e87879","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100637","source_published_at":"2026-09-26T13:23:11.226+00:00","published_at":"2026-10-24T23:05:08.591646+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100637"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID","summary":"SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries.","evidence":"cve:CVE-2026-100637","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100637","aliases":["CVE-2026-100637"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan","defaultStatus":"unaffected"}],"modified":"2026-10-05T15:06:34.280Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jhmh-hr4g-c5g2","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-path-traversal-via-checkoutrepo-sessionid"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100637","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T15:06:28.154306Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jhmh-hr4g-c5g2","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T15:06:34.280Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:11.226Z"}}},"related_cves":[{"value":"CVE-2026-100637","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":8688,"advisory_id":"65d3c242-0673-413c-aecd-cb507d03cfe3","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100633","source_published_at":"2026-09-26T13:23:08.505+00:00","published_at":"2026-10-24T23:05:07.997565+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100633"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations","summary":"SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from resolvePath()) is applied only to the allowed root of recursive operations and not to each resolved descendant path — an incomplete fix for GHSA-c8r8-95hg-mp34. An authenticated administrator using the in-app Agent or the external MCP server can therefore bypass the protected-workspace-file denylist: file.grep can return matching lines from non-hidden protected descendants (for example conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, or the kernel log), file.copy can copy protected descendants to an ordinary path where file.read can then retrieve them, and unzip can overwrite protected descendants using ordinary, lexically contained ZIP member names. Because file.grep is globally classified as a safe action, it receives no per-call confirmation, and the confirmation cards for file.copy and unzip show only the allowed root arguments. This issue is fixed in version 3.8.4. Suggested title: SiYuan 3.8.0 through 3.8.3 Sensitive-Path Guard Bypass in Recursive MCP File Operations.","evidence":"cve:CVE-2026-100633","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100633","aliases":["CVE-2026-100633"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"3.8.0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-05T15:21:18.882Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9g6v-r3xf-673q","https://www.vulncheck.com/advisories/siyuan-3.8.0-through-3.8.3-path-traversal-via-mcp-file-operations"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100633","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-05T15:20:59.180842Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T15:21:18.882Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:08.505Z"}}},"related_cves":[{"value":"CVE-2026-100633","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":8611,"advisory_id":"e2f18edd-cd56-4cc7-9ec2-6e09f4f5d987","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105205","source_published_at":"2026-10-04T13:10:00.765+00:00","published_at":"2026-10-24T23:03:28.872859+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-105205"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo","summary":"SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID to obtain refIDs and refCount of hidden referencing blocks, bypassing the publish confidentiality boundary.","evidence":"cve:CVE-2026-105205","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105205","aliases":["CVE-2026-105205"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.5","versionType":"semver"},{"status":"unaffected","version":"3.8.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-05T13:30:12.526Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v758-8w88-pfr2","https://www.vulncheck.com/advisories/siyuan-before-3.8.5-information-disclosure-via-api-block-getdocinfo-and-getdocsinfo"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105205","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T13:29:37.466760Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v758-8w88-pfr2","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T13:30:12.526Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-04T13:10:00.765Z"}}},"related_cves":[{"value":"CVE-2026-105205","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":8076,"advisory_id":"9efaeaf6-4878-4653-94d9-590d6617fd64","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104410","source_published_at":"2026-10-02T11:37:54.829+00:00","published_at":"2026-10-24T22:55:03.676377+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-104410"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before 3.8.5 Information Disclosure via /api/export/preview","summary":"SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.","evidence":"cve:CVE-2026-104410","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104410","aliases":["CVE-2026-104410"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.5","versionType":"semver"},{"status":"unaffected","version":"3.8.5","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-02T17:38:17.498Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-778g-gq49-fxxj","https://www.vulncheck.com/advisories/siyuan-before-3.8.5-information-disclosure-via-api-export-preview"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104410","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T17:37:34.990604Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-778g-gq49-fxxj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T17:38:17.498Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:37:54.829Z"}}},"related_cves":[{"value":"CVE-2026-104410","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":8001,"advisory_id":"b8bc3cc9-4d04-4359-93d1-e2df94923eb6","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103763","source_published_at":"2026-10-02T11:37:54.162+00:00","published_at":"2026-10-24T22:53:29.387611+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-103763"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo","summary":"SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.","evidence":"cve:CVE-2026-103763","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-103763","aliases":["CVE-2026-103763"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.5","versionType":"semver"},{"status":"unaffected","version":"3.8.5","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan","defaultStatus":"unaffected"}],"modified":"2026-10-02T15:50:33.523Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ccxp-q3vg-jvgj","https://www.vulncheck.com/advisories/siyuan-before-3.8.5-information-disclosure-via-api-notebook-getnotebookinfo"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103763","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T15:46:40.380045Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ccxp-q3vg-jvgj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T15:50:33.523Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:37:54.162Z"}}},"related_cves":[{"value":"CVE-2026-103763","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":5527,"advisory_id":"bfc31bd2-38bc-4f24-b6bf-bad4ba8092d7","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77086","source_published_at":"2026-08-21T11:05:12.989+00:00","published_at":"2026-10-24T22:10:02.606709+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-77086"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.7.4 Path Traversal via packageName","summary":"SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.","evidence":"cve:CVE-2026-77086","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-77086","aliases":["CVE-2026-77086"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.4,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.7.4","versionType":"semver"},{"status":"unaffected","version":"3.7.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-10-01T15:21:13.113Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wr4w-7vjm-mmx3","https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-packagename"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77086","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-21T11:45:56.651260Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-21T11:46:26.985Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:21:13.113Z"}}},"related_cves":[{"value":"CVE-2026-77086","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":5387,"advisory_id":"4a98f39a-9f53-47ca-b44b-5e4cd9c75f63","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101092","source_published_at":"2026-09-28T22:00:17.864+00:00","published_at":"2026-10-24T22:07:29.899786+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-101092"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages","summary":"SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny.","evidence":"cve:CVE-2026-101092","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101092","aliases":["CVE-2026-101092"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan","defaultStatus":"unaffected"}],"modified":"2026-10-01T15:06:32.347Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f","https://github.com/siyuan-note/siyuan/commit/48229dc76ce4212fe42295393af617947b157c15","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-information-disclosure-via-getcurrentattrviewimages"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101092","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T15:06:04.633276Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:06:32.347Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-28T22:00:17.864Z"}}},"related_cves":[{"value":"CVE-2026-101092","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4420,"advisory_id":"91d20039-a475-4075-8bef-80fdce9b5255","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100646","source_published_at":"2026-09-26T13:23:17.483+00:00","published_at":"2026-10-24T21:51:21.707091+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100646"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header","summary":"SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-initiated cross-site request carries an Origin. Because browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads — and the session cookie is SameSite=Lax — a single cross-site GET issued from any attacker-controlled web page is granted RoleAdministrator, both on default installations with no access-authorization code and on password-protected instances with a live session. Combined with content-type sniffing on the /api/network/proxy endpoint, which allows attacker-controlled HTML to be served under SiYuan's own origin, this permits an unauthenticated remote attacker to execute arbitrary script in the SiYuan origin (http://127.0.0.1:6806), invoke administrator APIs, and exfiltrate the persistent kernel API token. This issue is fixed in version 3.8.4.","evidence":"cve:CVE-2026-100646","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100646","aliases":["CVE-2026-100646"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan","defaultStatus":"unaffected"}],"modified":"2026-09-30T14:47:14.800Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2w6q-wgc8-q743","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-authentication-bypass-via-missing-origin-header"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100646","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T14:46:38.827782Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2w6q-wgc8-q743","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:47:14.800Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:17.483Z"}}},"related_cves":[{"value":"CVE-2026-100646","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4419,"advisory_id":"dcbab930-1973-41c1-91e9-9b5767ea707a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100642","source_published_at":"2026-09-26T13:23:14.649+00:00","published_at":"2026-10-24T21:51:21.382233+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100642"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth","summary":"SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.","evidence":"cve:CVE-2026-100642","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100642","aliases":["CVE-2026-100642"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"2.1.0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:45:54.559Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9gpj-3rm3-x42m","https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.4-cross-site-request-forgery-via-checkauth"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100642","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:45:17.397705Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9gpj-3rm3-x42m","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:45:54.559Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:14.649Z"}}},"related_cves":[{"value":"CVE-2026-100642","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4202,"advisory_id":"f215e4c2-d3ac-4b60-8449-2ea965e85933","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100638","source_published_at":"2026-09-26T13:23:11.93+00:00","published_at":"2026-10-24T21:48:03.259662+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100638"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Path Traversal via setNotebookIcon","summary":"SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook parameter to escape the workspace data directory and write conf.json files to arbitrary locations accessible by the kernel process.","evidence":"cve:CVE-2026-100638","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100638","aliases":["CVE-2026-100638"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan","defaultStatus":"unaffected"}],"modified":"2026-09-30T13:02:17.513Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6h8x-6mph-7438","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-path-traversal-via-setnotebookicon"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100638","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T13:01:55.950410Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6h8x-6mph-7438","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T13:02:17.513Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:11.930Z"}}},"related_cves":[{"value":"CVE-2026-100638","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3895,"advisory_id":"58206a4f-61fa-444d-8980-8db689771372","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101091","source_published_at":"2026-09-28T22:00:17.204+00:00","published_at":"2026-10-24T21:42:53.854754+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-101091"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 SQL Injection via Block Query Embed","summary":"SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.","evidence":"cve:CVE-2026-101091","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-101091","aliases":["CVE-2026-101091"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-09-29T18:01:40.913Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67p9-hm94-xwf3","https://github.com/siyuan-note/siyuan/commit/e8ace0c89182c7ee1a1298ff2a849bb6a83dfdec","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-block-query-embed"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101091","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T18:01:34.331649Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67p9-hm94-xwf3","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T18:01:40.913Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-28T22:00:17.204Z"}}},"related_cves":[{"value":"CVE-2026-101091","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3311,"advisory_id":"35565c31-6c5d-4404-8d06-ceabadb49731","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100639","source_published_at":"2026-09-26T13:23:12.602+00:00","published_at":"2026-10-24T21:33:26.690566+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100639"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL","summary":"SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4.","evidence":"cve:CVE-2026-100639","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100639","aliases":["CVE-2026-100639"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"0","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T18:51:14.199Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2cmm-9x9j-rvff","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-kramdown-ial"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100639","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T18:49:39.724850Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2cmm-9x9j-rvff","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:51:14.199Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:12.602Z"}}},"related_cves":[{"value":"CVE-2026-100639","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3298,"advisory_id":"fefa2b6a-1fcc-4a2d-993a-be6b5fc57c09","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100643","source_published_at":"2026-09-26T13:23:15.365+00:00","published_at":"2026-10-24T21:32:17.560209+00:00","extraction_method":"structured","technologies":["core-cve","siyuan"],"cve_ids":["CVE-2026-100643"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SiYuan before v3.8.4 Stored XSS via Attribute View textarea","summary":"SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.","evidence":"cve:CVE-2026-100643","products":[{"name":{"value":"siyuan","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100643","aliases":["CVE-2026-100643"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"status":"affected","version":"2.10.8","lessThan":"3.8.4","versionType":"semver"},{"status":"unaffected","version":"3.8.4","versionType":"semver"}],"packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:32:45.015Z","provider":"cve","references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h3p6-c22r-fx2j","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-attribute-view-textarea"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100643","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T18:30:56.049987Z"}}}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h3p6-c22r-fx2j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:32:45.015Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:15.365Z"}}},"related_cves":[{"value":"CVE-2026-100643","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":20590,"next_before":3298}