A critical information disclosure vulnerability in SiYuan allows unauthenticated remote attackers to extract sensitive configuration data and API keys.

This vulnerability involves the improper exposure of Go net/http/pprof debug endpoints. Because these endpoints are enabled without authentication when the software is not running in production mode, an attacker can perform unauthenticated requests to retrieve memory dumps containing critical secrets.

The compromise of AccessAuthCode and AI provider API keys can lead to significant unauthorized access, data theft, and financial costs associated with hijacked cloud services. With a CVSS score of 9.3, this flaw is considered critical because it requires no authentication and provides direct access to sensitive internal application data.

Immediate Action: Upgrade the SiYuan installation to version 3.7.4 or later immediately. Ensure that the application is explicitly configured to run in production mode to disable debug endpoints.

Proactive Monitoring: Review application access logs for unusual requests to /debug/pprof/* paths. Monitor for unauthorized usage of any API keys that were potentially exposed.

Compensating Controls: Deploy a Web Application Firewall (WAF) to explicitly block access to any URI paths starting with /debug/pprof/ from external network ranges.

Public Exploit Available: No (exploit_available: false)

Given the critical severity and the potential for total credential compromise, administrators must prioritize this update. Immediate patching is the only reliable method to ensure that sensitive memory contents are no longer exposed to unauthenticated network actors.