Executive brief
SiYuan is a note-taking application that includes an AI Agent feature powered by MCP (Model Context Protocol) tools. The asset.upload tool allows the AI Agent to copy files into the workspace without validating that source files stay within workspace boundaries. An attacker can craft malicious prompts to trick the AI Agent into uploading sensitive files like SSH keys or AWS credentials from the user's system into the workspace, where they become accessible to anyone with workspace access or via export/sync features.
Technical details
The vulnerability is a path-traversal flaw in the asset.upload MCP tool (kernel/mcp/tools/asset.go:195). The files argument accepts arbitrary absolute file paths but only normalizes them with filepath.Abs() without performing workspace boundary validation (IsSubPath check) or sensitive-path detection (IsSensitivePath check). The downstream InsertLocalAssets function (kernel/model/upload.go:97) then opens and copies each file into the workspace assets directory. Attack requires an AI Agent/MCP surface to be configured and user approval of an upload confirmation dialog that does not display the specific source path. Prompt injection allows an attacker to induce the Agent to invoke asset.upload with external paths like /Users/victim/.ssh/id_rsa or ~/.aws/credentials. The vulnerability affects SiYuan versions up to and including 3.8.0; a patch was released in v3.8.1.
Affected products
- SiYuan SiYuan before 3.8.1
Timeline
- 2026-08-13: disclosed: Vulnerability disclosed to SiYuan
- 2026-08-28: advisory: CVE-2026-82233 published
- 2026-08-13: patched: Patched in v3.8.1