pkg:Go/github.com/siyuan-note/siyuan/kernel

86 total CVEsCRITICAL19HIGH22MEDIUM12

✅ Check your installed version

All known vulnerabilities

  • CRITICAL9.9CVE-2026-32938SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
    from 0
  • CRITICAL9.9CVE-2026-32938SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
    from 0, <= 0.0.0-20260313024916-fd6526133bb3
  • CRITICAL9.8CVE-2026-33670SiYuan has directory traversal within its publishing service
    from 0, <= 0.0.0-20260317012524-fe4523fff2c8
  • CRITICAL9.8CVE-2026-33670SiYuan has directory traversal within its publishing service
    from 0
  • CRITICAL9.8CVE-2026-33669SiYuan has Arbitrary Document Reading within the Publishing Service
    from 0, <= 0.0.0-20260317012524-fe4523fff2c8
  • CRITICAL9.8CVE-2026-33669SiYuan has Arbitrary Document Reading within the Publishing Service
    from 0
  • CRITICAL9.8CVE-2026-32767SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
    from 0
  • CRITICAL9.8CVE-2026-32767SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
    from 0, <= 0.0.0-20260313024916-fd6526133bb3
  • CRITICAL9.6CVE-2026-34449SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
    from 0, < 3.6.2
  • CRITICAL9.3CVE-2026-30869SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
    from 0
  • CRITICAL9.3CVE-2026-30869SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
    from 0, < 3.5.10
  • CRITICAL9.3CVE-2026-29183SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint
    from 0, < 0.0.0-20260304034809-d68bd5a79391
  • CRITICAL9.3CVE-2026-29183SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint
    from 0, < 0.0.0-20260304034809-d68bd5a79391
  • CRITICAL9.1CVE-2026-25539SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE in github.com/siyuan-note/siyuan/kernel
    from 0, <= 0.0.0-20260126094835-d5d10dd41b0c
  • CRITICAL9.1CVE-2026-25539SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE in github.com/siyuan-note/siyuan/kernel
    from 0
  • CRITICAL9.0CVE-2026-45375SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution
    from 0, <= 0.0.0-20260421031503-96dfe0bea474
  • CRITICAL9.0CVE-2026-45375SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution
    from 0
  • CRITICAL9.0CVE-2026-39846SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
    from 0, < 0.0.0-20260407035653-2f416e5253f1
  • CRITICAL9.0CVE-2026-34448SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client
    from 0, < 3.6.2
  • HIGH8.6CVE-2026-34585SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution
    from 0, < 0.0.0-20260329142331-918d1bd9f967
  • HIGH8.5CVE-2026-40318SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
    from 0, < 3.6.40.0.0-20260407035653-2f416e5253f1
  • HIGH8.3CVE-2026-32110SiYuan has a Full-Read SSRF via /api/network/forwardProxy
    from 0, < 3.6.0
  • HIGH8.3CVE-2026-32110SiYuan has a Full-Read SSRF via /api/network/forwardProxy
    from 0
  • HIGH8.1CVE-2026-40259SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView`
    from 0, < 0.0.0-20260407035653-2f416e5253f1
  • HIGH7.8CVE-2025-67488SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE in github.com/siyuan-note/siyuan/kernel
    from 0
  • HIGH7.8CVE-2025-67488SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE in github.com/siyuan-note/siyuan/kernel
    from 0, <= 0.0.0-20251202123337-6ef83b42c7ce
  • HIGH7.6CVE-2026-32749SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write
    from 0, <= 0.0.0-20260313024916-fd6526133bb3
  • HIGH7.6CVE-2026-32749SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write
    from 0
  • HIGH7.5CVE-2026-34453SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark
    from 0, < 3.6.2
  • HIGH7.5CVE-2026-33476Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal
    from 0, <= 0.0.0-20260317012524-fe4523fff2c8
  • HIGH7.5CVE-2026-33476Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal
    from 0
  • HIGH7.5CVE-2026-33203SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
    from 0
  • HIGH7.5CVE-2026-33203SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
    from 0, < 3.6.2
  • HIGH7.5CVE-2026-25992SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal
    from 0, <= 0.0.0-20260126094835-d5d10dd41b0c
  • HIGH7.5CVE-2026-25992SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal
    from 0
  • HIGH7.5CVE-2024-55657SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel
    from 0
  • HIGH7.5CVE-2024-55657SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel
    from 0, <= 0.0.0-20241210012039-5129ad926a21
  • HIGH7.5CVE-2024-55658SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
    from 0
  • HIGH7.5CVE-2024-55658SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
    from 0, <= 0.0.0-20241210012039-5129ad926a21
  • HIGH7.1CVE-2026-30926SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren
    from 0
  • HIGH7.1CVE-2026-30926SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren
    from 0, <= 0.0.0-20260304035530-d03ebdec8279
  • MEDIUM6.8CVE-2026-33194SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
    from 0
  • MEDIUM6.8CVE-2026-33194SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
    from 0, < 3.6.2
  • MEDIUM6.8CVE-2026-32747SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets
    from 0
  • MEDIUM6.8CVE-2026-32747SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets
    from 0, <= 0.0.0-20260313024916-fd6526133bb3
  • MEDIUM6.5CVE-2026-32704SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB
    from 0, < 3.6.1
  • MEDIUM6.5CVE-2026-32704SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB
    from 0
  • MEDIUM6.1CVE-2026-34605SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated)
    from 0, < 0.0.0-20260330031106-f09953afc57a
  • MEDIUM5.4CVE-2026-40922SiYuan has incomplete fix for CVE-2026-33066: XSS
    from 0, < 0.0.0-20260414013942-62eed37a3263
  • MEDIUM4.6CVE-2026-23847SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel
    from 0, < 0.0.0-20260118021606-5c0cc375b475
  • MEDIUM4.6CVE-2026-23847SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel
    from 0, < 0.0.0-20260118021606-5c0cc375b475
  • MEDIUM4.3CVE-2026-45148SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode
    from 0, < 0.0.0-20260512140701-d7b77d945e0d
  • MEDIUM4.3CVE-2026-45147SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk
    from 0, < 0.0.0-20260512140701-d7b77d945e0d
  • —CVE-2026-45371SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs
    from 0, < 0.0.0-20260512140701-d7b77d945e0d
  • —CVE-2026-44588SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)
    from 0, <= 0.0.0-20260421031503-96dfe0bea474
  • —CVE-2026-44588SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)
    from 0
  • —CVE-2026-44670SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE
    from 0, < 0.0.0-20260512140701-d7b77d945e0d
  • —CVE-2026-44670SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE
    from 0, < 0.0.0-20260512140701-d7b77d945e0d
  • —CVE-2026-41894SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)
    from 0, < 3.6.5
  • —CVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
    from 0, < 0.0.0-20260407035653-2f416e5253f1
  • —CVE-2026-33067SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata
    from 0, < 0.0.0-20260317012524-fe4523fff2c8
  • —CVE-2026-33067SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata
    from 0, < 0.0.0-20260317012524-fe4523fff2c8
  • —CVE-2026-33066SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
    from 0, < 0.0.0-20260314111550-b382f50e1880
  • —CVE-2026-33066SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
    from 0, < 0.0.0-20260314111550-b382f50e1880
  • —CVE-2026-32751SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface
    from 0
  • —CVE-2026-32751SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface
    from 0, <= 0.0.0-20260313024916-fd6526133bb3
  • —CVE-2026-32815SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure
    from 0, <= 0.0.0-20260313024916-fd6526133bb3
  • —CVE-2026-32815SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure
    from 0
  • —CVE-2026-31809SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS
    from 0, < 0.0.0-20260310025236-297bd526708f
  • —CVE-2026-31809SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS
    from 0, < 0.0.0-20260310025236-297bd526708f
  • —CVE-2026-31807SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS
    from 0, < 0.0.0-20260310025236-297bd526708f
  • —CVE-2026-31807SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS
    from 0, < 0.0.0-20260310025236-297bd526708f
  • —CVE-2026-29073SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access
    from 0, <= 0.0.0-20260113130602-4ba64580c29c
  • —CVE-2026-29073SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access
    from 0
  • —CVE-2026-23850SiYuan vulnerable to Arbitrary file Read / SSRF in github.com/siyuan-note/siyuan/kernel
    from 0, < 0.0.0-20260118092326-b2274baba2e1
  • —CVE-2026-23850SiYuan vulnerable to Arbitrary file Read / SSRF in github.com/siyuan-note/siyuan/kernel
    from 0, < 0.0.0-20260118092326-b2274baba2e1
  • —CVE-2026-23851SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in github.com/siyuan-note/siyuan/kernel
    from 0, < 0.0.0-20260118092521-f8f4b517077b
  • —CVE-2026-23851SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in github.com/siyuan-note/siyuan/kernel
    from 0, < 0.0.0-20260118092521-f8f4b517077b
  • —CVE-2026-23645SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload in github.com/siyuan-note/siyuan/kernel
    from 0, < 0.0.0-20260116101155-11115da3d0de
  • —CVE-2026-23645SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload in github.com/siyuan-note/siyuan/kernel
    from 0, < 0.0.0-20260116101155-11115da3d0de
  • —CVE-2025-21609SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel
    from 0
  • —CVE-2025-21609SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel
    from 0
  • —CVE-2024-55659SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel
    from 0
  • —CVE-2024-55659SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel
    from 0, <= 0.0.0-20241210012039-5129ad926a21
  • —CVE-2024-55660SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel
    from 0, <= 0.0.0-20241210012039-5129ad926a21
  • —CVE-2024-55660SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel
    from 0