siyuan.

SiYuan before v3.8.1 Path Traversal via /api/template/render

• siyuan
• Information disclosure

SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path

• siyuan
• CWE-427

SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

• siyuan
• Path traversal

SiYuan before v3.8.0 Secret Exfiltration via http_request URL

• siyuan
• Information disclosure

SiYuan before v3.7.4 Path Traversal via packageName

• siyuan
• Path traversal

SiYuan before v3.7.4 XSS-to-RCE via pathName.ts

• siyuan
• Cross-site scripting (XSS)

SiYuan XSS-to-RCE via unescaped block metadata in hint popup

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.4 Incorrect Authorization via Publish Access

• siyuan
• Broken access control

SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

• siyuan
• Server-side request forgery (SSRF)

SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM

• siyuan
• Denial of service

SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

• siyuan
• Cross-site scripting (XSS)

SiYuan before 3.7.4 Brute-Force Authentication via Publish Service

• siyuan
• Authentication bypass

SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth

• siyuan
• Cross-site request forgery (CSRF)

SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe

• siyuan
• Command injection

SiYuan before v3.7.4 Stored XSS via assets endpoint

• siyuan
• Cross-site scripting (XSS)

SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure

• siyuan
• CWE-215

SiYuan kernel Path Traversal via database_clean MCP tool

• siyuan
• Path traversal

SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token

• siyuan
• Authentication bypass

SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.4 Stored XSS via select option color

• siyuan
• Cross-site scripting (XSS)

siyuan before v3.7.4 Server-Side Template Injection via attribute-view

• siyuan
• Information disclosure

SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth

• siyuan
• Authentication bypass

SiYuan before 3.7.4 Brute-Force via authFilePublishAccess

• siyuan
• Authentication bypass

SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.4 Remote Code Execution via Template Calculation

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.4 Remote Code Execution via Menu Metadata

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

• siyuan
• Broken access control

SiYuan before v3.7.4 Information Disclosure via Local Storage

• siyuan
• Broken access control

SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL

• siyuan
• Cross-site scripting (XSS)

SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

• siyuan
• Broken access control

SiYuan before v3.7.2 Cross-Site Scripting to RCE

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

• siyuan
• Cross-site scripting (XSS)

SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace

• siyuan
• CWE-693

SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)

• siyuan
• Broken access control

SiYuan: Store XSS To Rce via Asset.render

• siyuan
• Cross-site scripting (XSS)

SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)

• siyuan
• Cross-site scripting (XSS)
• Code injection

SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)

• siyuan
• Cross-site scripting (XSS)
• Code injection

SiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client

• siyuan
• Cross-site scripting (XSS)

SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution

• siyuan
• Cross-site scripting (XSS)
• Code injection

SiYuan Desktop Notification XSS Leads to Electron RCE

• siyuan
• Command injection
• Cross-site scripting (XSS)

SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

• siyuan
• Cross-site scripting (XSS)
• Code injection

Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink

• siyuan
• Cross-site scripting (XSS)

SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute

• siyuan
• Code injection

SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret

• siyuan
• Hard-coded credentials

SiYuan PDF PDF.js cross site scripting

• SiYuan
• Cross-site scripting (XSS)

SiYuan 3.0.3 - RCE via Server Side XSS

• SiYuan
• Cross-site scripting (XSS)