Skip to content
OpenAdvisories

Package · Go

github.com/siyuan-note/siyuan/kernel

113 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

43 results · Clear filters · Feed

  • Medium 5.7
    CVE-2026-29073

    SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access

    SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Medium 5.3
    CVE-2026-23645

    SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload

    SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malici…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Medium 6.9
    CVE-2024-55660

    SiYuan has an SSTI via /api/template/renderSprig

    SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows a…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go