Executive brief
SiYuan Note, a personal knowledge management system, contains a security flaw that allows any installed browser extension to access its administrative functions without a password. This could allow a malicious or compromised browser extension to steal a user's private notes, inject malicious scripts, or change application settings. The risk is particularly high for desktop users where this protection is disabled by default.
Technical details
An origin validation error (CWE-346) exists in the SiYuan kernel's authentication middleware. Specifically, `kernel/model/session.go` contains a check that exempts any request with a `chrome-extension://` origin prefix from authentication, automatically assigning it `RoleAdministrator`. Because desktop installations often have an empty `AccessAuthCode` by default, any Chrome/Chromium extension can make arbitrary API calls to the local kernel at `127.0.0.1:6806`. Attackers can leverage this to exfiltrate data via SQL queries, inject stored XSS into notes, or modify system configurations. A patch is available in version 0.0.0-20260628153353-2d5d72223df4.
Affected products
- siyuan-note SiYuan <= v3.6.5
Timeline
- 2026-06-24: advisory: NVD publication date
- 2026-07-10: disclosed: GitHub Advisory published
- 2026-06-28: patched: Fix commit date