Skip to content
OpenAdvisories

Vendor

siyuan-note

221 known vulnerabilities.

Products

siyuan 221
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-100633 Public exploit

    SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations

    SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from resolvePath()) is applied only to the allowed root of recursive operations and not…

    siyuan-note siyuan
  • Medium 5.3
    CVE-2026-33067 Public exploit

    SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

    SiYuan is a personal knowledge management system. Versions 3.6.0 and below render package metadata fields (displayName, description) using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fiel…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go