---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: < 3.7.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan is vulnerable to stored Cross-Site Scripting (XSS) due to improper neutralization of script-related HTML tags, potentially allowing remote execution of malicious scripts.

Executive Summary:
An unauthenticated Cross-Site Scripting (XSS) vulnerability in SiYuan could allow attackers to execute arbitrary code in the context of a user's session.

Vulnerability Details

CVE-ID: CVE-2026-59855

Affected Software: SiYuan

Affected Versions: < 3.7.1

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-80) resulting from the failure to properly sanitize HTML input. As the attack vector is network-based and requires no authentication, an attacker can inject malicious scripts into the application that execute when viewed by other users.

Business Impact

Successful exploitation of this vulnerability can lead to full account takeover, session hijacking, and the theft of sensitive personal knowledge data stored within the SiYuan instance. With a CVSS score of 8.6, this flaw presents a high risk of unauthorized access and potential data exfiltration, significantly impacting the confidentiality and integrity of the user's workspace.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.1 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review web access logs for unusual patterns or payloads containing script tags associated with user input fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be loaded, which may mitigate the impact of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity and the ease of exploitation, organizations and individuals using SiYuan must prioritize updating to version 3.7.1. Failure to patch may allow attackers to compromise the integrity of the knowledge management system and gain unauthorized access to stored data.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: < 3.7.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan is vulnerable to path traversal, allowing authenticated users to access sensitive files outside of the intended directory structure.

Executive Summary:
A path traversal vulnerability in SiYuan allows an authenticated user to read sensitive files from the server, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-59832

Affected Software: SiYuan SiYuan

Affected Versions: < 3.7.1

Vulnerability: This vulnerability is a path traversal flaw (CWE-22/CWE-23) that allows an authenticated attacker to escape the application's root directory. The attack is performed over the network and requires the attacker to have an existing user account.

Business Impact

With a CVSS score of 7.7, this vulnerability represents a high risk to data confidentiality. An attacker could exploit this flaw to read arbitrary files on the server, potentially exposing configuration files, credentials, or sensitive user data, leading to a total breach of the application's security posture.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.7.1 or later to resolve the path traversal flaw.

Proactive Monitoring: Review application access logs for attempts to use directory traversal sequences (e.g., "../") in requests.

Compensating Controls: Implement strict file system permissions for the user running the SiYuan service to ensure the application cannot access files outside of its designated data directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing SiYuan must prioritize upgrading to version 3.7.1. Given the risk of unauthorized file access, failing to patch this vulnerability leaves the environment exposed to credential theft and sensitive data exfiltration by authenticated users.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Before v3.6.1
---END_METADATA---

Description Summary:
SiYuan versions before 3.6.1 contain an XSS vulnerability in the Bazaar marketplace that allows remote code execution via malicious package metadata.

Executive Summary:
A critical vulnerability in the SiYuan Bazaar marketplace allows unauthenticated attackers to achieve remote code execution on user systems by injecting malicious payloads into package metadata.

Vulnerability Details

CVE-ID: CVE-2026-56397

Affected Software: SiYuan SiYuan

Affected Versions: Before v3.6.1

Vulnerability: This is a cross-site scripting (XSS) vulnerability residing in the package metadata processing logic. By embedding malicious payloads in package fields, an attacker can leverage Electron's nodeIntegration settings to escape the sandbox and execute arbitrary OS commands.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a severe risk to organizational security. Successful exploitation grants an attacker full control over the victim's local machine, potentially leading to data exfiltration, lateral movement within the network, and complete system compromise.

Remediation Plan

Immediate Action: Upgrade all SiYuan installations to version 3.6.1 or later immediately to apply the required input sanitization patches.

Proactive Monitoring: Review application logs for unusual package metadata submissions or unexpected outbound network connections originating from the SiYuan application process.

Compensating Controls: If immediate patching is not possible, restrict network access to the Bazaar marketplace or implement strict egress filtering to prevent unauthorized command-and-control communication.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability to achieve remote code execution, this vulnerability represents a critical security risk. Organizations should prioritize the update to version 3.6.1 across all endpoints to eliminate the risk of arbitrary code execution via the Bazaar marketplace.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Before v3.6.1
---END_METADATA---

Description Summary:
SiYuan versions before 3.6.1 contain an XSS vulnerability in the Bazaar marketplace that allows remote code execution via malicious package metadata.

Executive Summary:
A critical vulnerability in the SiYuan Bazaar marketplace allows unauthenticated attackers to achieve remote code execution on user systems by injecting malicious payloads into package metadata.

Vulnerability Details

CVE-ID: CVE-2026-56395

Affected Software: SiYuan SiYuan

Affected Versions: Before v3.6.1

Vulnerability: This is a cross-site scripting (XSS) vulnerability residing in the package metadata processing logic. By embedding malicious payloads in package fields, an attacker can leverage Electron's nodeIntegration settings to escape the sandbox and execute arbitrary OS commands.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a severe risk to organizational security. Successful exploitation grants an attacker full control over the victim's local machine, potentially leading to data exfiltration, lateral movement within the network, and complete system compromise.

Remediation Plan

Immediate Action: Upgrade all SiYuan installations to version 3.6.1 or later immediately to apply the required input sanitization patches.

Proactive Monitoring: Review application logs for unusual package metadata submissions or unexpected outbound network connections originating from the SiYuan application process.

Compensating Controls: If immediate patching is not possible, restrict network access to the Bazaar marketplace or implement strict egress filtering to prevent unauthorized command-and-control communication.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability to achieve remote code execution, this vulnerability represents a critical security risk. Organizations should prioritize the update to version 3.6.1 across all endpoints to eliminate the risk of arbitrary code execution via the Bazaar marketplace.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Note
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the SiYuan personal knowledge management system that may compromise user data integrity.

Executive Summary:
The SiYuan personal knowledge management system is susceptible to a high-severity vulnerability that could result in unauthorized access to sensitive user data.

Vulnerability Details

CVE-ID: CVE-2026-54759

Affected Software: SiYuan SiYuan Note

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the SiYuan knowledge management platform. As the system handles sensitive personal and organizational data, flaws of this nature often involve unauthorized access or data manipulation, requiring immediate attention to prevent information disclosure.

Business Impact

With a CVSS score of 8.7, this vulnerability represents a high risk to the confidentiality and integrity of information stored within the SiYuan platform. Unauthorized access could lead to the exfiltration of proprietary knowledge, personal notes, and sensitive project documentation, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the SiYuan development team immediately upon release.

Proactive Monitoring: Audit user access logs within the application to identify any unusual administrative activities or unauthorized data access patterns.

Compensating Controls: If the instance is internet-facing, place the application behind a Web Application Firewall (WAF) to filter malicious requests until patching is completed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users and administrators of the SiYuan platform must treat this vulnerability with high priority. Implementing the vendor-supplied patch is the only effective way to mitigate this risk; until then, ensure that access to the application is strictly limited to authorized personnel.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to 3.7.0
---END_METADATA---

Description Summary:
A critical XSS vulnerability in SiYuan's attribute-view cell renderer allows attackers to inject malicious scripts, leading to remote code execution on Electron desktop clients.

Executive Summary:
A high-severity XSS vulnerability in SiYuan’s database cell rendering allows for remote code execution on Electron-based desktop clients through weaponized attribute-view data.

Vulnerability Details

CVE-ID: CVE-2026-54158

Affected Software: SiYuan SiYuan

Affected Versions: Prior to 3.7.0

Vulnerability: The application fails to properly sanitize cell content in attribute-view rendering, allowing an attacker to inject malicious payloads into text, URL, phone, or mAsset fields. This leads to arbitrary JavaScript execution in the renderer process, which, due to nodeIntegration:true in Electron, results in host-level RCE.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a severe threat, enabling attackers to compromise the entire host operating system. Successful exploitation allows for persistent access to the victim's machine, potentially leading to the theft of sensitive proprietary knowledge and credentials stored within the application or on the local device.

Remediation Plan

Immediate Action: Patch SiYuan to version 3.7.0 or higher to implement mandatory input sanitization for database cell rendering.

Proactive Monitoring: Monitor workspace synchronization logs for unusual cell content or patterns that deviate from standard data entry.

Compensating Controls: Restrict collaborative editing access in shared workspaces to trusted individuals only until patches are fully deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to trigger RCE via simple data entry makes this a critical security priority. System administrators must ensure that all instances are updated to the latest version to prevent malicious actors from leveraging synced workspaces as an attack vector.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Note
AFFECTED_VERSIONS: Prior to 3.7.0
---END_METADATA---

Description Summary:
The SiYuan kernel HTTP server improperly trusts browser extension origins, allowing unauthenticated administrative API access and potential data exfiltration.

Executive Summary:
The SiYuan kernel HTTP server contains a critical authentication bypass flaw that allows malicious browser extensions to perform administrative actions without authorization.

Vulnerability Details

CVE-ID: CVE-2026-54069

Affected Software: SiYuan SiYuan Note

Affected Versions: Prior to 3.7.0

Vulnerability: The kernel HTTP server fails to perform proper origin validation, unconditionally trusting all browser extensions. Combined with a default empty authentication code, this allows unauthenticated attackers to execute administrative API calls.

Business Impact

This vulnerability carries a CVSS score of 9.2, representing an extremely high risk. Successful exploitation allows unauthorized parties to exfiltrate sensitive personal knowledge data, tamper with application configurations, and inject malicious scripts, effectively granting the attacker full administrative control over the application state.

Remediation Plan

Immediate Action: Update SiYuan to version 3.7.0 or later and ensure that a strong, non-default AccessAuthCode is configured immediately.

Proactive Monitoring: Review application logs for unexpected API calls originating from unauthorized or unrecognized browser-based sources.

Compensating Controls: Use network-level controls or host-based firewalls to restrict access to the SiYuan kernel port (6806) to trusted local processes only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on default configurations and permissive origin policies creates a significant security gap. Users must update to the latest version and enforce robust authentication protocols to prevent unauthorized administrative access to their knowledge base.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to 3.7.0
---END_METADATA---

Description Summary:
A cross-site scripting (XSS) vulnerability in SiYuan's CSS snippet rendering allows attackers to execute arbitrary JavaScript, leading to remote code execution (RCE) on Electron desktop builds.

Executive Summary:
A critical XSS vulnerability in SiYuan's CSS snippet rendering allows for remote code execution on Electron-based desktop clients when malicious snippets are synced and rendered.

Vulnerability Details

CVE-ID: CVE-2026-54067

Affected Software: SiYuan SiYuan

Affected Versions: Prior to 3.7.0

Vulnerability: This vulnerability involves improper sanitization of CSS snippet bodies, where an attacker can inject malicious tags to break out of the rendering context. Because the Electron renderer operates with nodeIntegration:true, this XSS can be escalated to full RCE by an authenticated user with write access to a synced workspace.

Business Impact

The potential for remote code execution on the host machine presents an extreme risk to organizational data and system integrity. Given the 9.9 CVSS score, this vulnerability could allow an attacker to gain full control over the user's local environment, potentially exfiltrating sensitive knowledge management data or moving laterally within the network.

Remediation Plan

Immediate Action: Upgrade all SiYuan desktop instances to version 3.7.0 or later immediately to patch the rendering logic.

Proactive Monitoring: Review workspace repository logs for unauthorized modifications or suspicious CSS snippet injections.

Compensating Controls: Restrict write access to shared workspaces and enforce strict policies on the use of custom CSS or JS snippets within the knowledge base.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it transitions a simple XSS into a full system compromise. Organizations utilizing SiYuan must prioritize the update to version 3.7.0 across all client machines to mitigate the risk of RCE.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to 3.7.0
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the SiYuan Attribute View allows for remote code execution (RCE) within the Electron desktop client.

Executive Summary:
The SiYuan personal knowledge management system is vulnerable to a critical stored XSS flaw that enables remote code execution on the desktop client.

Vulnerability Details

CVE-ID: CVE-2026-50551

Affected Software: SiYuan SiYuan

Affected Versions: Prior to 3.7.0

Vulnerability: This vulnerability involves a stored XSS flaw within the database asset cell renderer. An attacker can leverage this to execute arbitrary code within the context of the Electron desktop client, bypassing standard application boundaries.

Business Impact

The ability to achieve remote code execution poses a severe threat to data integrity, confidentiality, and host security. With a CVSS score of 9.9, this vulnerability could allow an attacker to gain full control over the user's local machine, leading to total compromise of personal knowledge data and potentially lateral movement within the host environment.

Remediation Plan

Immediate Action: Upgrade the SiYuan desktop client to version 3.7.0 or later immediately to apply the necessary security patches.

Proactive Monitoring: Monitor local system activity for unusual process spawning originating from the SiYuan application.

Compensating Controls: Ensure the application is running in an environment with restricted permissions to limit the impact of a potential RCE event.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this RCE vulnerability, immediate action is required. Organizations and individuals using the SiYuan desktop client must prioritize updating to version 3.7.0 to eliminate the execution vector and protect sensitive local data.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to 3.7.0
---END_METADATA---

Description Summary:
A stored Cross-Site Scripting (XSS) vulnerability in the SiYuan Marketplace allows attackers to execute arbitrary HTML/JS via malicious package metadata.

Executive Summary:
A critical XSS vulnerability in the SiYuan Marketplace allows attackers to execute arbitrary code in the context of a user's browser.

Vulnerability Details

CVE-ID: CVE-2026-45375

Affected Software: SiYuan

Affected Versions: Prior to 3.7.0

Vulnerability: The application fails to properly escape package metadata (name/version) fields, allowing malicious HTML/JS to be rendered and executed when a user views the Marketplace UI.

Business Impact

Successful exploitation allows an attacker to perform actions on behalf of the victim, potentially stealing session tokens or sensitive knowledge management data. With a CVSS score of 9.0, this is a significant threat to user-level security within the SiYuan environment.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.7.0 or later to ensure proper sanitization of marketplace content.

Proactive Monitoring: Review application logs for unusual client-side errors or unexpected script execution patterns within the browser.

Compensating Controls: Use a modern browser with robust CSP (Content Security Policy) headers to restrict the execution of unauthorized scripts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should update their SiYuan installations immediately. Protecting users from malicious marketplace content is essential to maintaining the security of the personal knowledge management system.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 3.6.3 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.3 and below are vulnerable to stored XSS in Mermaid diagrams, which can be escalated to arbitrary code execution on Electron-based desktop builds.

Executive Summary:
A critical vulnerability in SiYuan allows unauthenticated attackers to achieve arbitrary code execution via malicious Mermaid diagram injections.

Vulnerability Details

CVE-ID: CVE-2026-40322

Affected Software: SiYuan SiYuan

Affected Versions: 3.6.3 and below

Vulnerability: This vulnerability involves an improper rendering of Mermaid diagrams where "loose" security settings allow JavaScript injection. When processed within an Electron environment lacking context isolation, this stored XSS is escalated to arbitrary code execution.

Business Impact

The ability to execute arbitrary code on a user's machine poses a severe risk to confidentiality, integrity, and availability. With a CVSS score of 9.0, this flaw allows an attacker to compromise local data, install persistence, or pivot into the internal network.

Remediation Plan

Immediate Action: Upgrade the SiYuan application to version 3.6.4 or later immediately.

Proactive Monitoring: Review audit logs for suspicious activity involving note creation or unexpected external network connections originating from the application.

Compensating Controls: Restrict the use of untrusted Mermaid diagrams within the workspace until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete system compromise, organizations should prioritize the update to version 3.6.4 across all desktop instances. Failure to patch leaves the local environment exposed to malicious code execution.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Desktop Client
AFFECTED_VERSIONS: Prior to 3.6.4
---END_METADATA---

Description Summary:
SiYuan personal knowledge management system is vulnerable to stored XSS, which can lead to remote code execution in the Electron desktop client.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan allows an attacker to achieve remote code execution on a victim's machine by syncing a malicious note.

Vulnerability Details

CVE-ID: CVE-2026-39846

Affected Software: SiYuan Desktop Client

Affected Versions: Prior to 3.6.4

Vulnerability: The vulnerability is caused by improper escaping of table caption content, which creates a stored XSS sink. Because the desktop client (based on Electron) operates with nodeIntegration enabled and contextIsolation disabled, the injected JavaScript gains full access to Node.js APIs, enabling remote code execution.

Business Impact

With a CVSS score of 9.0, this flaw poses a severe risk to users. Exploitation allows an attacker to execute arbitrary commands on the user's local workstation, potentially leading to the theft of local credentials, private notes, and complete compromise of the local environment.

Remediation Plan

Immediate Action: Update the SiYuan desktop client to version 3.6.4 or later immediately.

Proactive Monitoring: Users should monitor for suspicious note activity or unexpected synchronization behavior if they suspect their account has been compromised.

Compensating Controls: While difficult to mitigate via network controls, users should avoid syncing or opening notes from untrusted or unknown sources within the SiYuan platform.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All users of the SiYuan desktop client must update to version 3.6.4 or later. Given the ability to achieve code execution through simple note synchronization, this update should be treated as a high-priority security maintenance task.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to version 3.6.2
---END_METADATA---

Description Summary:
SiYuan desktop application is vulnerable to Remote Code Execution via a permissive CORS policy. A malicious website can inject JavaScript into the Electron Node.js context without user interaction.

Executive Summary:
SiYuan's permissive CORS policy allows a malicious website to achieve Remote Code Execution on a user's desktop simply by having the victim visit a URL while the application is running.

Vulnerability Details

CVE-ID: CVE-2026-34449

Affected Software: SiYuan

Affected Versions: Prior to version 3.6.2

Vulnerability: The application implements a highly permissive CORS policy (Access-Control-Allow-Origin: *) that allows unauthenticated external websites to interact with its local API. An attacker can use this to inject a malicious JavaScript snippet that executes within the Electron Node.js context the next time the UI is opened.

Business Impact

This vulnerability poses a severe threat to individual workstation security and corporate data privacy. An attacker can gain full OS-level access to the victim's machine, allowing for the theft of sensitive notes, local files, and saved credentials. The CVSS score of 9.6 highlights the critical risk of zero-interaction RCE via a standard web browser.

Remediation Plan

Immediate Action: Update the SiYuan desktop application to version 3.6.2 or later to resolve the CORS policy and API injection flaws.

Proactive Monitoring: Monitor for unexpected outbound network connections from the SiYuan process and inspect local application logs for unauthorized API calls.

Compensating Controls: Utilize endpoint detection and response (EDR) tools to block suspicious child processes spawned by Electron-based applications.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. However, the requirement for only a simple website visit makes this a highly attractive target for watering hole attacks.

Analyst Recommendation

Because this vulnerability requires no direct user interaction other than visiting a malicious site, it is a high-priority threat. Administrators should ensure all users update their desktop clients immediately. Failure to patch leaves the local system entirely vulnerable to remote takeover through common web browsing activity.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Versions prior to 3.6.2
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.6.2 allow unauthenticated directory traversal and filename retrieval via the /api/file/readDir interface, exposing the structure of user notebooks.

Executive Summary:
A critical information disclosure vulnerability in SiYuan allows unauthenticated attackers to map and retrieve the names of all documents within a notebook by abusing the file directory API.

Vulnerability Details

CVE-ID: CVE-2026-33670

Affected Software: SiYuan

Affected Versions: Versions prior to 3.6.2

Vulnerability: The /api/file/readDir interface lacks sufficient authorization checks, allowing an unauthenticated attacker to traverse the file structure and retrieve the names of all documents. This serves as a reconnaissance vector for further data theft.

Business Impact

While this specific CVE focuses on filename retrieval, it provides the necessary metadata for an attacker to target specific sensitive documents for exfiltration. The CVSS score of 9.8 reflects the high risk of data exposure and the lack of authentication required to perform the traversal.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.6.2 or higher immediately.

Proactive Monitoring: Review application logs for unauthorized calls to the /api/file/readDir endpoint.

Compensating Controls: Restrict access to the SiYuan API via firewall rules or host-level access control lists (ACLs) to ensure only trusted devices can interact with the service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability, combined with CVE-2026-33669, allows for the complete automated harvesting of a user's knowledge base. Immediate patching is the only effective way to secure the application against unauthenticated discovery.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Versions prior to 3.6.2
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.6.2 are vulnerable to unauthorized data access where document IDs and content can be retrieved through the /api/file/readDir and /api/block/getChildBlocks interfaces.

Executive Summary:
SiYuan knowledge management systems are vulnerable to a critical information disclosure flaw that allows unauthenticated attackers to view the full content of all stored documents via API abuse.

Vulnerability Details

CVE-ID: CVE-2026-33669

Affected Software: SiYuan

Affected Versions: Versions prior to 3.6.2

Vulnerability: The vulnerability stems from insecure API endpoints that do not properly restrict access to document identifiers and content. An unauthenticated attacker can first list document IDs and then programmatically retrieve the full text of those documents using the /api/block/getChildBlocks interface.

Business Impact

For a personal knowledge management system, this vulnerability represents a total loss of confidentiality for all stored data. The CVSS score of 9.8 is justified by the fact that sensitive personal or corporate information can be harvested remotely without any authentication.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.2 or later to secure the affected API endpoints.

Proactive Monitoring: Monitor network traffic for excessive requests to the /api/block/ and /api/file/ endpoints, especially from unrecognized IP addresses.

Compensating Controls: If the application is hosted on a network, use an authentication proxy or VPN to restrict access to the SiYuan web interface to authorized users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because SiYuan is often used to store highly sensitive personal or organizational data, this unauthenticated access flaw is critical. Users should update immediately and ensure their instances are not exposed to the public internet without additional layers of authentication.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Knowledge Management System
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The SiYuan personal knowledge management system contains a security flaw that poses a risk to the confidentiality and integrity of stored information.

Executive Summary:
A vulnerability in the SiYuan system allows for potential unauthorized access to sensitive knowledge bases, necessitating an immediate security update.

Vulnerability Details

CVE-ID: CVE-2026-33476

Affected Software: SiYuan SiYuan Knowledge Management System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the SiYuan application, a tool used for private data management. Given the high CVSS severity, the flaw likely permits an attacker to bypass security controls or execute unauthorized commands within the application environment.

Business Impact

A successful exploit could allow an attacker to read, modify, or delete sensitive notes and documents stored within the SiYuan system. For organizations using SiYuan for internal documentation, this could result in the leak of proprietary research or strategic plans. The 7.5 CVSS score indicates that the risk to data confidentiality and availability is substantial.

Remediation Plan

Immediate Action: Immediately update SiYuan to the latest version as specified in the vendor's security advisory.

Proactive Monitoring: Monitor system resource usage and file integrity within the SiYuan directory to detect potential unauthorized modifications.

Compensating Controls: Implement strict file system permissions and use a Web Application Firewall (WAF) to filter suspicious traffic targeting the knowledge management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of personal knowledge management tools makes them attractive targets for targeted information-gathering attacks.

Analyst Recommendation

Immediate patching is the primary and most effective defense against this vulnerability. Users should not delay in applying updates, as the high severity score suggests that the flaw could be easily leveraged if technical details become public. Ensure that all backups of the knowledge base are encrypted and stored securely during the update process.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below contain a click-through XSS vulnerability in the dynamic icon API due to incomplete SVG sanitization.

Executive Summary:
SiYuan knowledge management systems are vulnerable to a critical click-through XSS attack that can lead to unauthorized JavaScript execution via malicious SVG files.

Vulnerability Details

CVE-ID: CVE-2026-32940

Affected Software: SiYuan (Personal Knowledge Management System)

Affected Versions: 3.6.0 and below

Vulnerability: The /api/icon/getDynamicIcon endpoint serves user-controlled input directly into SVG markup without escaping. The sanitization process misses certain XML MIME types, allowing an unauthenticated attacker to craft a URL that, when clicked by a victim, executes JavaScript within the context of the application.

Business Impact

A successful Cross-Site Scripting (XSS) attack can allow an attacker to steal session cookies, perform actions on behalf of the user, or deface the application. Although it requires a "click-through," the high CVSS score of 9.3 highlights the significant risk to user data and the potential for session hijacking in a knowledge-heavy environment.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.1 or later to implement the corrected SVG sanitization logic and input escaping.

Proactive Monitoring: Inspect application logs for unusual parameters being passed to the dynamic icon API and monitor for reports of suspicious links within the SiYuan community.

Compensating Controls: Implement a strong Content Security Policy (CSP) that restricts the execution of inline scripts and prevents the loading of objects from untrusted origins.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. The vulnerability is technically detailed, suggesting that proof-of-concept exploits could be developed quickly.

Analyst Recommendation

The risk of XSS in a productivity tool like SiYuan is substantial. Users should update to version 3.6.1 immediately. Until the patch is applied, users should be warned against clicking on unknown links that point to their SiYuan instance's dynamic icon API.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below are vulnerable to path traversal and sensitive file exfiltration via improper validation of file:// links in pasted HTML.

Executive Summary:
SiYuan knowledge management systems are vulnerable to sensitive file exfiltration, allowing attackers to copy and read local files via crafted HTML content.

Vulnerability Details

CVE-ID: CVE-2026-32938

Affected Software: SiYuan (Personal Knowledge Management System)

Affected Versions: 3.6.0 and below

Vulnerability: The /api/lute/html2BlockDOM endpoint fails to validate file:// links in pasted HTML against a sensitive-path list. An attacker can trick the system into copying local files into the assets directory, which can then be accessed by an authenticated visitor via the GET /assets/*path endpoint.

Business Impact

The impact of this vulnerability is critical, as it allows for the unauthorized exfiltration of sensitive system files, including configuration files and personal data. With a CVSS score of 9.9, the risk to data confidentiality is extreme. Organizations or individuals using SiYuan for sensitive knowledge management could face significant data breaches and loss of privacy.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.1 or later immediately to resolve the path validation flaw.

Proactive Monitoring: Review the workspace assets directory for any unexpected files that may have been copied from sensitive local system paths.

Compensating Controls: Restrict access to the SiYuan web interface and disable the ability to paste HTML from untrusted sources until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the technical details provided in the disclosure make it relatively straightforward for an attacker to craft an exploit.

Analyst Recommendation

The high CVSS score of 9.9 necessitates an immediate update to version 3.6.1. Users should be cautioned against pasting content from untrusted sources into the application until the update is confirmed. Prioritize the protection of the host machine's filesystem by applying the fix now.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to version 3.5.9
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.5.9 contain an unauthenticated reflected XSS vulnerability in the dynamic icon API endpoint, allowing JavaScript execution via crafted SVG outputs.

Executive Summary:
A critical unauthenticated reflected cross-site scripting (XSS) vulnerability in SiYuan allows remote attackers to execute arbitrary JavaScript and exfiltrate sensitive user data.

Vulnerability Details

CVE-ID: CVE-2026-29183

Affected Software: SiYuan Knowledge Management System

Affected Versions: Prior to version 3.5.9

Vulnerability: This flaw exists in the GET /api/icon/getDynamicIcon endpoint when the type parameter is set to 8. An unauthenticated attacker can provide malicious content that is embedded into an SVG output without proper escaping, leading to JavaScript execution in the context of the user's web session.

Business Impact

A successful exploit allows an attacker to perform actions on behalf of a logged-in user, potentially leading to the full compromise of the personal knowledge management system. With a CVSS score of 9.3, the risk is critical as it can result in the exfiltration of sensitive private notes, research, and authentication tokens, causing significant privacy breaches and data loss.

Remediation Plan

Immediate Action: Administrators and individual users must update SiYuan to version 3.5.9 or later immediately to patch the vulnerable API endpoint.

Proactive Monitoring: Security teams should review web server logs for suspicious requests to the /api/icon/getDynamicIcon endpoint, specifically looking for unusual characters or script tags in the query parameters.

Compensating Controls: Implementing a strict Content Security Policy (CSP) that restricts script execution and object-src can help mitigate the impact of XSS vulnerabilities if updates cannot be applied instantly.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw is unauthenticated and can be triggered via a simple URL, the likelihood of exploitation is extremely high once the technical details are widely known.

Analyst Recommendation

The severity of this reflected XSS vulnerability cannot be overstated given its unauthenticated nature and the sensitive data typically stored within SiYuan. It is highly recommended that all users apply the version 3.5.9 update immediately to protect their data from unauthorized exfiltration and session hijacking.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to version 3.5.5
---END_METADATA---

Description Summary:
SiYuan's /api/file/copyFile endpoint fails to validate the 'dest' parameter, allowing authenticated users to write files to arbitrary locations, potentially leading to Remote Code Execution (RCE).

Executive Summary:
An arbitrary file write vulnerability in SiYuan allows authenticated users to achieve Remote Code Execution by overwriting critical system files such as cron jobs or SSH keys.

Vulnerability Details

CVE-ID: CVE-2026-25539

Affected Software: SiYuan Personal Knowledge Management System

Affected Versions: Prior to version 3.5.5

Vulnerability: The vulnerability is located in the /api/file/copyFile endpoint, where the dest parameter lacks proper validation. This allows an authenticated attacker to perform a path traversal attack to write files into sensitive directories, such as shell configuration files or authorized_keys.

Business Impact

While the attack requires authentication, the impact is critical (CVSS 9.1) as it facilitates full system compromise. An attacker could gain persistent access to the server, leading to the total loss of data integrity and confidentiality. This could result in the exposure of private knowledge bases and lateral movement within the corporate network.

Remediation Plan

Immediate Action: Update the SiYuan installation to version 3.5.5 or higher immediately to apply the necessary input validation patches.

Proactive Monitoring: Review system-level logs for unauthorized modifications to sensitive files like /etc/crontab, ~/.ssh/authorized_keys, and shell profiles.

Compensating Controls: Restrict access to the SiYuan API to trusted networks and implement the principle of least privilege for the user account running the SiYuan service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for authentication slightly reduces the risk compared to unauthenticated flaws, but the RCE potential remains a critical threat.

Analyst Recommendation

The ability to write to arbitrary filesystem locations is a high-risk condition. Organizations should enforce immediate updates to version 3.5.5 and audit the server for any signs of unauthorized persistence mechanisms.