{"schema_version":1,"title":"SiYuan Note vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 57 vulnerabilities in SiYuan Note: 5 in the last 7 days and 37 in the last 90 days, 16 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100644, was published on 26 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/siyuan-note","json_url":"https://junglewise.ai/threats/vendors/siyuan-note.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/siyuan-note","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":23,"all_time":57,"critical":16,"exploited":0,"last_7_days":5,"last_30_days":19,"last_90_days":37,"last_365_days":57},"latest":[{"cve":"CVE-2026-100644","cvss":7.5,"slug":"cve-2026-100644-siyuan-before-v3-8-4-contains-a-sql-injection-vulnerability-in","title":"SiYuan SQL injection in graph query endpoint","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:46.583+00:00","url":"https://junglewise.ai/threats/cve-2026-100644-siyuan-before-v3-8-4-contains-a-sql-injection-vulnerability-in"},{"cve":"CVE-2026-100640","cvss":4.7,"slug":"cve-2026-100640-siyuan-before-v3-8-4-contains-an-authorization-omission-in-the","title":"SiYuan authorization omission in siyuan-get IPC handler","severity":"medium","exploited":false,"published_at":"2026-09-26T14:16:45.82+00:00","url":"https://junglewise.ai/threats/cve-2026-100640-siyuan-before-v3-8-4-contains-an-authorization-omission-in-the"},{"cve":"CVE-2026-100639","cvss":8.8,"slug":"cve-2026-100639-siyuan-v3-8-3-fails-to-html-escape-the-data-subtype-attribute","title":"SiYuan gutter attribute injection and remote code execution","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:45.633+00:00","url":"https://junglewise.ai/threats/cve-2026-100639-siyuan-v3-8-3-fails-to-html-escape-the-data-subtype-attribute"},{"cve":"CVE-2026-100638","cvss":7.6,"slug":"cve-2026-100638-siyuan-versions-before-v3-8-4-contain-a-path-traversal","title":"SiYuan path traversal in setNotebookIcon","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:45.48+00:00","url":"https://junglewise.ai/threats/cve-2026-100638-siyuan-versions-before-v3-8-4-contain-a-path-traversal"},{"cve":"CVE-2026-100637","cvss":7.6,"slug":"cve-2026-100637-siyuan-versions-before-v3-8-4-contain-a-path-traversal","title":"SiYuan path traversal in checkoutRepo endpoint","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:45.32+00:00","url":"https://junglewise.ai/threats/cve-2026-100637-siyuan-versions-before-v3-8-4-contain-a-path-traversal"},{"cve":"CVE-2026-93922","cvss":8.8,"epss":0.0082,"slug":"cve-2026-93922-siyuan-through-3-8-4-renders-notebook-names-as-raw-html-in-the","title":"SiYuan stored cross-site scripting in Daily Note picker","severity":"high","exploited":false,"published_at":"2026-09-19T00:16:57.783+00:00","url":"https://junglewise.ai/threats/cve-2026-93922-siyuan-through-3-8-4-renders-notebook-names-as-raw-html-in-the"},{"cve":"CVE-2026-93921","cvss":4.3,"epss":0.0038,"slug":"cve-2026-93921-siyuan-versions-through-3-8-4-fail-to-enforce-publish-access","title":"SiYuan access control bypass in getDynamicIcon endpoint","severity":"medium","exploited":false,"published_at":"2026-09-19T00:16:57.553+00:00","url":"https://junglewise.ai/threats/cve-2026-93921-siyuan-versions-through-3-8-4-fail-to-enforce-publish-access"},{"slug":"go-2026-6430-siyuan-database-view-structure-all-view-names-layout-types-ffc5d2e2","title":"SiYuan database view metadata disclosure via API endpoint","severity":"info","exploited":false,"published_at":"2026-09-10T14:48:42+00:00","url":"https://junglewise.ai/threats/go-2026-6430-siyuan-database-view-structure-all-view-names-layout-types-ffc5d2e2"},{"cve":"CVE-2026-72795","cvss":8.6,"epss":0.0041,"slug":"cve-2026-72795-siyuan-embedded-block-content-leak-via-missing-publish-access","title":"SiYuan embedded block content leak via missing publish-access filtering","severity":"high","exploited":false,"published_at":"2026-09-04T21:13:13+00:00","url":"https://junglewise.ai/threats/cve-2026-72795-siyuan-embedded-block-content-leak-via-missing-publish-access"},{"cve":"CVE-2026-72794","cvss":8.6,"epss":0.0042,"slug":"cve-2026-72794-siyuan-session-cookie-signing-key-disclosure-in-api-system","title":"SiYuan session-cookie signing key disclosure in /api/system/getConf","severity":"high","exploited":false,"published_at":"2026-09-04T21:12:26+00:00","url":"https://junglewise.ai/threats/cve-2026-72794-siyuan-session-cookie-signing-key-disclosure-in-api-system"},{"cve":"CVE-2026-72796","cvss":5.8,"epss":0.0035,"slug":"cve-2026-72796-siyuan-static-routes-access-control-bypass","title":"SiYuan static routes access control bypass","severity":"medium","exploited":false,"published_at":"2026-09-04T21:02:22+00:00","url":"https://junglewise.ai/threats/cve-2026-72796-siyuan-static-routes-access-control-bypass"},{"cve":"CVE-2026-72798","cvss":8.6,"epss":0.0043,"slug":"cve-2026-72798-siyuan-renderattributeview-missing-authorization-in-related","title":"SiYuan renderAttributeView missing authorization in related-database content","severity":"high","exploited":false,"published_at":"2026-09-04T20:58:04+00:00","url":"https://junglewise.ai/threats/cve-2026-72798-siyuan-renderattributeview-missing-authorization-in-related"},{"cve":"CVE-2026-72803","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72803-siyuan-missing-publish-access-filter-on-getblockattrs-and","title":"SiYuan missing publish-access filter on getBlockAttrs and batchGetBlockAttrs","severity":"medium","exploited":false,"published_at":"2026-09-03T22:58:29+00:00","url":"https://junglewise.ai/threats/cve-2026-72803-siyuan-missing-publish-access-filter-on-getblockattrs-and"},{"cve":"CVE-2026-72804","cvss":8.6,"epss":0.0043,"slug":"cve-2026-72804-siyuan-graph-endpoints-bypass-publish-password-protection","title":"SiYuan graph endpoints bypass publish password protection","severity":"high","exploited":false,"published_at":"2026-09-03T22:52:58+00:00","url":"https://junglewise.ai/threats/cve-2026-72804-siyuan-graph-endpoints-bypass-publish-password-protection"},{"cve":"CVE-2026-72809","cvss":8,"epss":0.003,"slug":"cve-2026-72809-siyuan-kernel-localhost-trust-admin-bypass-on-auth-gated","title":"SiYuan kernel localhost-trust admin bypass on auth-gated endpoints","severity":"high","exploited":false,"published_at":"2026-09-03T22:34:06+00:00","url":"https://junglewise.ai/threats/cve-2026-72809-siyuan-kernel-localhost-trust-admin-bypass-on-auth-gated"},{"cve":"CVE-2026-72810","cvss":8.6,"epss":0.0054,"slug":"cve-2026-72810-siyuan-publish-boundary-bypass-via-websocket-broadcast","title":"SiYuan publish-boundary bypass via WebSocket broadcast","severity":"high","exploited":false,"published_at":"2026-09-03T22:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-72810-siyuan-publish-boundary-bypass-via-websocket-broadcast"},{"cve":"CVE-2026-68584","cvss":8.6,"epss":0.0054,"slug":"cve-2026-68584-siyuan-password-protected-document-bypass-via-content-api","title":"SiYuan password-protected document bypass via content API endpoints","severity":"high","exploited":false,"published_at":"2026-09-03T21:22:42+00:00","url":"https://junglewise.ai/threats/cve-2026-68584-siyuan-password-protected-document-bypass-via-content-api"},{"cve":"CVE-2026-69083","cvss":10,"epss":0.0048,"slug":"cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp","title":"SiYuan fullTextSearchAssetContent SQL injection and REGEXP breakout","severity":"critical","exploited":false,"published_at":"2026-09-03T21:01:05+00:00","url":"https://junglewise.ai/threats/cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp"},{"cvss":6.5,"slug":"siyuan-path-traversal-in-export-temp-branch-6fc4f947","title":"SiYuan path traversal in /export/temp/ branch","severity":"medium","exploited":false,"published_at":"2026-09-03T14:56:31+00:00","url":"https://junglewise.ai/threats/siyuan-path-traversal-in-export-temp-branch-6fc4f947"},{"cve":"CVE-2026-73047","cvss":6.2,"epss":0.0019,"slug":"cve-2026-73047-siyuan-server-side-template-injection-in-attribute-view","title":"siyuan server-side template injection in attribute-view calculation","severity":"medium","exploited":false,"published_at":"2026-08-15T22:16:54.737+00:00","url":"https://junglewise.ai/threats/cve-2026-73047-siyuan-server-side-template-injection-in-attribute-view"},{"cve":"CVE-2026-73609","cvss":5.8,"epss":0.0033,"slug":"cve-2026-73609-siyuan-getbookmarklabels-information-disclosure","title":"SiYuan getBookmarkLabels information disclosure","severity":"medium","exploited":false,"published_at":"2026-08-13T12:17:25.463+00:00","url":"https://junglewise.ai/threats/cve-2026-73609-siyuan-getbookmarklabels-information-disclosure"},{"cvss":8.6,"slug":"siyuan-session-cookie-signing-key-disclosure-via-api-system-getconf-722c1d76","title":"Siyuan session cookie signing key disclosure via /api/system/getConf","severity":"high","exploited":false,"published_at":"2026-08-12T21:31:41+00:00","url":"https://junglewise.ai/threats/siyuan-session-cookie-signing-key-disclosure-via-api-system-getconf-722c1d76"},{"cvss":7.7,"slug":"siyuan-path-traversal-in-attribute-view-read-endpoints-b8bb1fdc","title":"SiYuan path traversal in attribute-view read endpoints","severity":"high","exploited":false,"published_at":"2026-08-03T15:32:48+00:00","url":"https://junglewise.ai/threats/siyuan-path-traversal-in-attribute-view-read-endpoints-b8bb1fdc"},{"cvss":8.6,"slug":"siyuan-missing-authorization-in-heading-transaction-endpoints-1bb25867","title":"SiYuan missing authorization in heading transaction endpoints","severity":"high","exploited":false,"published_at":"2026-08-03T15:32:47+00:00","url":"https://junglewise.ai/threats/siyuan-missing-authorization-in-heading-transaction-endpoints-1bb25867"},{"cvss":5.8,"slug":"siyuan-metadata-disclosure-in-getblockinfo-endpoint-e5095957","title":"SiYuan metadata disclosure in getBlockInfo endpoint","severity":"medium","exploited":false,"published_at":"2026-08-03T15:32:47+00:00","url":"https://junglewise.ai/threats/siyuan-metadata-disclosure-in-getblockinfo-endpoint-e5095957"}],"vendor":{"hub":true,"name":"SiYuan Note","slug":"siyuan-note","url":"https://junglewise.ai/threats/vendors/siyuan-note"},"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":3,"exploited":0,"vulnerabilities":4},{"week":"2026-07-27","critical":1,"exploited":0,"vulnerabilities":3},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":1,"exploited":0,"vulnerabilities":11},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-69083","cvss":10,"epss":0.0048,"slug":"cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp","title":"SiYuan fullTextSearchAssetContent SQL injection and REGEXP breakout","severity":"critical","exploited":false,"published_at":"2026-09-03T21:01:05+00:00","url":"https://junglewise.ai/threats/cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp"},{"cve":"CVE-2026-66012","cvss":10,"slug":"cve-2026-66012-siyuan-missing-authorization-in-mcp-kernel-endpoint","title":"SiYuan missing authorization in MCP kernel endpoint","severity":"critical","exploited":false,"published_at":"2026-07-25T11:17:19.053+00:00","url":"https://junglewise.ai/threats/cve-2026-66012-siyuan-missing-authorization-in-mcp-kernel-endpoint"},{"cve":"CVE-2026-50551","cvss":9.9,"epss":0.0078,"slug":"cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer","title":"SiYuan stored XSS to RCE in Attribute View asset cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:47.513+00:00","url":"https://junglewise.ai/threats/cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer"},{"cve":"CVE-2026-54067","cvss":9.9,"epss":0.0054,"slug":"cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout","title":"SiYuan stored XSS to RCE via CSS snippet breakout","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.177+00:00","url":"https://junglewise.ai/threats/cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout"},{"cve":"CVE-2026-54158","cvss":9.9,"epss":0.0051,"slug":"cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer","title":"SiYuan Stored XSS to RCE in attribute-view cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.74+00:00","url":"https://junglewise.ai/threats/cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer"},{"cve":"CVE-2026-34449","cvss":9.6,"epss":0.008,"slug":"cve-2026-34449-siyuan-rce-via-permissive-cors-policy-and-snippet-injection","title":"SiYuan RCE via permissive CORS policy and snippet injection","severity":"critical","exploited":false,"published_at":"2026-03-31T22:16:19.83+00:00","url":"https://junglewise.ai/threats/cve-2026-34449-siyuan-rce-via-permissive-cors-policy-and-snippet-injection"},{"cve":"CVE-2026-66395","cvss":9.6,"slug":"cve-2026-66395-siyuan-desktop-reflected-xss-to-rce-in-bazaar-plugin-handler","title":"SiYuan Desktop reflected XSS to RCE in bazaar plugin handler","severity":"critical","exploited":false,"published_at":"2026-07-27T16:18:12.083+00:00","url":"https://junglewise.ai/threats/cve-2026-66395-siyuan-desktop-reflected-xss-to-rce-in-bazaar-plugin-handler"},{"cve":"CVE-2026-65606","cvss":9.6,"slug":"cve-2026-65606-siyuan-xss-to-rce-in-siyuan-protocol-handler","title":"SiYuan XSS to RCE in siyuan:// protocol handler","severity":"critical","exploited":false,"published_at":"2026-07-23T12:18:47.493+00:00","url":"https://junglewise.ai/threats/cve-2026-65606-siyuan-xss-to-rce-in-siyuan-protocol-handler"},{"cve":"CVE-2026-65605","cvss":9.6,"slug":"cve-2026-65605-siyuan-stored-xss-to-rce-in-attribute-view-database-cells","title":"SiYuan stored XSS to RCE in Attribute View database cells","severity":"critical","exploited":false,"published_at":"2026-07-23T12:18:47.357+00:00","url":"https://junglewise.ai/threats/cve-2026-65605-siyuan-stored-xss-to-rce-in-attribute-view-database-cells"},{"cve":"CVE-2026-34448","cvss":9,"epss":0.0073,"slug":"cve-2026-34448-siyuan-stored-xss-and-rce-in-attribute-view-gallery-cover","title":"SiYuan stored XSS and RCE in Attribute View gallery cover rendering","severity":"critical","exploited":false,"published_at":"2026-03-31T22:16:19.657+00:00","url":"https://junglewise.ai/threats/cve-2026-34448-siyuan-stored-xss-and-rce-in-attribute-view-gallery-cover"}],"generated_at":"2026-09-28T03:07:00.154823+00:00","technologies":[{"name":"SiYuan Note SiYuan","slug":"siyuan-note-siyuan","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/siyuan-note-siyuan"}]}