Skip to content
OpenAdvisories

Package · Go

github.com/siyuan-note/siyuan/kernel

113 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-69084 Public exploit

    SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

    SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Critical 10.0
    CVE-2026-69083 Public exploit

    SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

    SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via u…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Medium 5.3
    CVE-2026-33067 Public exploit

    SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

    SiYuan is a personal knowledge management system. Versions 3.6.0 and below render package metadata fields (displayName, description) using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fiel…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go