Skip to content
OpenAdvisories

Vendor

siyuan-note

225 known vulnerabilities.

Products

siyuan 225
All Critical High Medium Low Exploited only Public exploit

88 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-31809 Scanner template

    SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

    SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) checks href attributes for the javascript: prefix using strings.HasPrefix(). However, inserting ASCII tab (	), newline (
), or carriage return (&#13…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Medium 6.4
    CVE-2026-31807 Scanner template

    SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

    SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. However, it does NOT blo…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Medium 5.7
    CVE-2026-29073

    SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access

    SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Medium 4.6
    CVE-2026-25647

    Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink

    Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the Markdown rendering engine. An attacker can inject malicious JavaScript into a Mar…

    siyuan-note siyuan
  • Medium 5.8
    CVE-2026-23852

    SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute

    SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject arbitrary HTML attributes into the `icon` attribute of a block via the `/api/attr/setBlockAttrs`…

    siyuan-note siyuan
  • Medium 5.3
    CVE-2026-23645

    SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload

    SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malici…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Medium 6.9
    CVE-2025-68948

    SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret

    SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffectiv…

    siyuan-note siyuan
  • Medium 6.9
    CVE-2024-55660

    SiYuan has an SSTI via /api/template/renderSprig

    SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows a…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go