SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

{
  "id": "b5eecc591aec3504432e9930b8ed0408f782e6bee19727164fbd0fccd721a652",
  "url": "https://osv.dev/vulnerability/GHSA-xp3q-r38w-vgqm",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized",
    "summary": "### Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit `63c7d5474` resolved it by removing `FilterUILayoutByPublishIgnore` and nulling `Conf.UILayout` for readers. That fix is correct and complete for the live layout. This report concerns a different endpoint, a different filter function and a different storage backing. `/api/storage/getLocalStorage` reads `data/storage/local.json` rather than `Conf.UILayout`, and its filter `FilterLocalStorageByPublishAccess` was not touched by that commit. The consequence is that the same serialized tab objects the earlier fix withheld continue to be served, from the closed-tab history rather than the live layout. ### Summary Three routes, `/api/storage/getLocalStorage`, `getLocalStorageVal` and `getLocalStorageVals`, are registered with `CheckAuth` only and are reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`. All three call `model.GetLocalStorage()` and then, for read-only roles, `FilterLocalStorageByPublishAccess`. That filter begins by assigning the administrator's entire storage map to its return value and then removes three specific fields. Everything else in the map is returned unmodified. A single unauthenticated POST with an empty body returns the administrator's recently closed tabs with their document titles and identifiers, their current search keywords and the paths those searches cover, the expanded private paths in their f",
    "evidence": "osv:GHSA-xp3q-r38w-vgqm",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260729005258-4daee87d4152",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-xp3q-r38w-vgqm",
      "aliases": [
        "GHSA-xp3q-r38w-vgqm"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260729005258-4daee87d4152"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xp3q-r38w-vgqm/GHSA-xp3q-r38w-vgqm.json"
          }
        }
      ],
      "modified": "2026-10-23T18:45:08.575715071Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xp3q-r38w-vgqm",
        "https://github.com/siyuan-note/siyuan/commit/4daee87d41521d119979f2edda67e87f2be7b6ef",
        "https://github.com/siyuan-note/siyuan",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.3"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-863"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-23T18:29:45Z"
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 424602,
  "published_at": "2026-10-23T18:29:45+00:00"
}