Description
SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | < 3.8.1 | 3.8.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | < 0.0.0-20260813142806-dd2778b70d02 | 0.0.0-20260813142806-dd2778b70d02 | GHSA-x8gv-g2g3-65fj |
References
- GitHub Security Advisory (GHSA-x8gv-g2g3-65fj) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU third-party-advisory