# SiYuan Note vulnerabilities Source: https://junglewise.ai/threats/vendors/siyuan-note Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/siyuan-note.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 62 vulnerabilities in SiYuan Note: 0 in the last 7 days and 18 in the last 90 days, 16 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116171, was published on 25 October 2026. 3 vulnerabilities in the last four weeks, down 70% on the four before (10). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 18 - All time: 62 (16 critical, 0 exploited in the wild) ## Latest SiYuan Note vulnerabilities - [CVE-2026-116171: SiYuan path-traversal bypass via Windows extended-length prefix](https://junglewise.ai/threats/cve-2026-116171-siyuan-3-5-4-before-3-8-7-on-windows-contains-a-sensitive-path) (high, CVSS 7.5, published 25 Oct 2026) - [CVE-2026-116169: SiYuan stored cross-site scripting in KaTeX math blocks](https://junglewise.ai/threats/cve-2026-116169-siyuan-from-2-10-0-before-3-8-7-contains-a-stored-cross-site) (medium, CVSS 5.4, published 25 Oct 2026) - [CVE-2026-116168: SiYuan path traversal in MCP asset tool via incomplete blacklist](https://junglewise.ai/threats/cve-2026-116168-siyuan-before-3-8-7-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.2, published 25 Oct 2026) - [SiYuan getAttributeViewSearchTarget insufficient access control](https://junglewise.ai/threats/go-2026-6632-siyuan-getattributeviewsearchtarget-returns-database-row-fd3e0f1a) (info, published 7 Oct 2026) - [CVE-2026-74802: SiYuan Cross-Site WebSocket Hijacking in network proxy endpoint](https://junglewise.ai/threats/cve-2026-74802-siyuan-cross-site-websocket-hijacking-on-the-admin-only-network) (low, CVSS 3.1, published 2 Oct 2026) - [CVE-2026-103762: SiYuan missing authorization in save-path resolver endpoints](https://junglewise.ai/threats/cve-2026-103762-siyuan-before-v3-8-5-contains-a-missing-authorization) (medium, CVSS 5.3, published 2 Oct 2026) - [CVE-2026-100644: SiYuan SQL injection in graph query endpoint](https://junglewise.ai/threats/cve-2026-100644-siyuan-before-v3-8-4-contains-a-sql-injection-vulnerability-in) (high, CVSS 7.5, published 26 Sep 2026) - [CVE-2026-100640: SiYuan authorization omission in siyuan-get IPC handler](https://junglewise.ai/threats/cve-2026-100640-siyuan-before-v3-8-4-contains-an-authorization-omission-in-the) (medium, CVSS 4.7, published 26 Sep 2026) - [CVE-2026-100639: SiYuan gutter attribute injection and remote code execution](https://junglewise.ai/threats/cve-2026-100639-siyuan-v3-8-3-fails-to-html-escape-the-data-subtype-attribute) (high, CVSS 8.8, published 26 Sep 2026) - [CVE-2026-100638: SiYuan path traversal in setNotebookIcon](https://junglewise.ai/threats/cve-2026-100638-siyuan-versions-before-v3-8-4-contain-a-path-traversal) (high, CVSS 7.6, published 26 Sep 2026) - [CVE-2026-100637: SiYuan path traversal in checkoutRepo endpoint](https://junglewise.ai/threats/cve-2026-100637-siyuan-versions-before-v3-8-4-contain-a-path-traversal) (high, CVSS 7.6, published 26 Sep 2026) - [CVE-2026-93922: SiYuan stored cross-site scripting in Daily Note picker](https://junglewise.ai/threats/cve-2026-93922-siyuan-through-3-8-4-renders-notebook-names-as-raw-html-in-the) (high, CVSS 8.8, published 19 Sep 2026) - [CVE-2026-93921: SiYuan access control bypass in getDynamicIcon endpoint](https://junglewise.ai/threats/cve-2026-93921-siyuan-versions-through-3-8-4-fail-to-enforce-publish-access) (medium, CVSS 4.3, published 19 Sep 2026) - [SiYuan database view metadata disclosure via API endpoint](https://junglewise.ai/threats/go-2026-6430-siyuan-database-view-structure-all-view-names-layout-types-ffc5d2e2) (info, published 10 Sep 2026) - [CVE-2026-72810: SiYuan publish-boundary bypass via WebSocket broadcast](https://junglewise.ai/threats/cve-2026-72810-siyuan-publish-boundary-bypass-via-websocket-broadcast) (high, CVSS 8.6, published 3 Sep 2026) - [CVE-2026-68584: SiYuan password-protected document bypass via content API endpoints](https://junglewise.ai/threats/cve-2026-68584-siyuan-password-protected-document-bypass-via-content-api) (high, CVSS 8.6, published 3 Sep 2026) - [CVE-2026-69083: SiYuan fullTextSearchAssetContent SQL injection and REGEXP breakout](https://junglewise.ai/threats/cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp) (critical, CVSS 10, published 3 Sep 2026) - [CVE-2026-73047: siyuan server-side template injection in attribute-view calculation](https://junglewise.ai/threats/cve-2026-73047-siyuan-server-side-template-injection-in-attribute-view) (medium, CVSS 6.2, published 15 Aug 2026) - [CVE-2026-73609: SiYuan getBookmarkLabels information disclosure](https://junglewise.ai/threats/cve-2026-73609-siyuan-getbookmarklabels-information-disclosure) (medium, CVSS 5.8, published 13 Aug 2026) - [Siyuan session cookie signing key disclosure via /api/system/getConf](https://junglewise.ai/threats/siyuan-session-cookie-signing-key-disclosure-via-api-system-getconf-722c1d76) (high, CVSS 8.6, published 12 Aug 2026) - [CVE-2026-72809: SiYuan kernel localhost-trust admin bypass on auth-gated endpoints](https://junglewise.ai/threats/cve-2026-72809-siyuan-kernel-localhost-trust-admin-bypass-on-auth-gated) (high, CVSS 8, published 12 Aug 2026) - [CVE-2026-72804: SiYuan graph endpoints bypass publish password protection](https://junglewise.ai/threats/cve-2026-72804-siyuan-graph-endpoints-bypass-publish-password-protection) (high, CVSS 8.6, published 12 Aug 2026) - [CVE-2026-72803: SiYuan missing publish-access filter on getBlockAttrs and batchGetBlockAttrs](https://junglewise.ai/threats/cve-2026-72803-siyuan-missing-publish-access-filter-on-getblockattrs-and) (medium, CVSS 5.8, published 12 Aug 2026) - [CVE-2026-72798: SiYuan renderAttributeView missing authorization in related-database content](https://junglewise.ai/threats/cve-2026-72798-siyuan-renderattributeview-missing-authorization-in-related) (high, CVSS 8.6, published 12 Aug 2026) - [CVE-2026-72796: SiYuan static routes access control bypass](https://junglewise.ai/threats/cve-2026-72796-siyuan-static-routes-access-control-bypass) (medium, CVSS 5.8, published 12 Aug 2026) ## Most severe SiYuan Note vulnerabilities - [CVE-2026-69083: SiYuan fullTextSearchAssetContent SQL injection and REGEXP breakout](https://junglewise.ai/threats/cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp) (critical, CVSS 10, published 3 Sep 2026) - [CVE-2026-66012: SiYuan missing authorization in MCP kernel endpoint](https://junglewise.ai/threats/cve-2026-66012-siyuan-missing-authorization-in-mcp-kernel-endpoint) (critical, CVSS 10, published 25 Jul 2026) - [CVE-2026-50551: SiYuan stored XSS to RCE in Attribute View asset cell renderer](https://junglewise.ai/threats/cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer) (critical, CVSS 9.9, published 24 Jun 2026) - [CVE-2026-54067: SiYuan stored XSS to RCE via CSS snippet breakout](https://junglewise.ai/threats/cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout) (critical, CVSS 9.9, published 24 Jun 2026) - [CVE-2026-54158: SiYuan Stored XSS to RCE in attribute-view cell renderer](https://junglewise.ai/threats/cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer) (critical, CVSS 9.9, published 24 Jun 2026) - [CVE-2026-34449: SiYuan RCE via permissive CORS policy and snippet injection](https://junglewise.ai/threats/cve-2026-34449-siyuan-rce-via-permissive-cors-policy-and-snippet-injection) (critical, CVSS 9.6, published 31 Mar 2026) - [CVE-2026-66395: SiYuan Desktop reflected XSS to RCE in bazaar plugin handler](https://junglewise.ai/threats/cve-2026-66395-siyuan-desktop-reflected-xss-to-rce-in-bazaar-plugin-handler) (critical, CVSS 9.6, published 27 Jul 2026) - [CVE-2026-65606: SiYuan XSS to RCE in siyuan:// protocol handler](https://junglewise.ai/threats/cve-2026-65606-siyuan-xss-to-rce-in-siyuan-protocol-handler) (critical, CVSS 9.6, published 23 Jul 2026) - [CVE-2026-65605: SiYuan stored XSS to RCE in Attribute View database cells](https://junglewise.ai/threats/cve-2026-65605-siyuan-stored-xss-to-rce-in-attribute-view-database-cells) (critical, CVSS 9.6, published 23 Jul 2026) - [CVE-2026-34448: SiYuan stored XSS and RCE in Attribute View gallery cover rendering](https://junglewise.ai/threats/cve-2026-34448-siyuan-stored-xss-and-rce-in-attribute-view-gallery-cover) (critical, CVSS 9, published 31 Mar 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 70% on the four before (10). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 3 | 1 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 5 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## SiYuan Note technologies - [SiYuan Note SiYuan](https://junglewise.ai/threats/technologies/siyuan-note-siyuan): 46 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "SiYuan Note vulnerabilities", https://junglewise.ai/threats/vendors/siyuan-note, 12 November 2026.