SiYuan vulnerabilities

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a heading block ID to read full rendered content of publish-disabled documents that should be restricted.

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle).

SiYuan before version v3.7.3 contains a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint. Anonymous readers or RoleReader tokens can retrieve the title, notebook, path, root ID, and icon of documents marked as excluded from publishing.

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.

A vulnerability in SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

A vulnerability in SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.

SiYuan before version 3.7.2 contains a path traversal vulnerability in the /export/temp/ branch of the serveExport handler. An authenticated attacker can use percent-encoded traversal sequences to read arbitrary files outside TempDir, including /etc/passwd, SSH keys, and database files.

A vulnerability in SiYuan before version 3.7.1 allows JavaScript injection via unsafe interpolation of the this.path value into innerHTML. A crafted asset link with a double quote can break out of the src attribute, inject an event handler, and execute code in the Electron renderer.

A vulnerability in SiYuan before version 3.7.1 allows an authenticated administrator or API-token user to copy sensitive credential files (e.g., .git-credentials, .netrc, .pgpass) into the workspace and exfiltrate them via the file API. The issue stems from insufficient path filtering in the util.IsSensitivePath function.

A vulnerability in SiYuan prior to version 3.7.1 allows a Reader user in publish mode to read private document paths, notebook, document, and block IDs, as well as search and replace keywords for unpublished documents. The issue is due to missing publish-access filtering on the /api/storage/getCriteria endpoint.

A vulnerability in SiYuan before version 3.7.1 allows an unauthenticated publish visitor to inject a UNION SELECT query into the block search endpoint. Attackers can read hidden documents by manipulating path values in POST requests.

SiYuan prior to 3.7.1 has a stored cross-site scripting (XSS) vulnerability in the HTML rendering via the Lute engine. The dangerous JavaScript scheme block does not check form action or SVG xlink:href attributes, allowing OS command execution in the Electron desktop renderer.

A vulnerability in SiYuan before version 3.7.1 allows reading files outside the snippets directory. The serveSnippets function improperly handles path traversal sequences like %2e%2e (..), enabling an authenticated attacker to read workspace secrets and the document database.

SiYuan is an open-source personal knowledge management system. In versions prior to 3.7.0, a vulnerability allowed an unauthenticated attacker to read arbitrary files in WorkspaceDir by double URL-encoding in the /assets/*path route.

In SiYuan personal knowledge management system prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, the filter FilterBlocksByPublishAccess treats a nil context as authorized, skipping the publish password check and returning bookmarked blocks from protected documents.

SiYuan versions 3.5.1 and prior use a hardcoded cryptographic secret for its session store, rendering session encryption ineffective. Since the sensitive AccessAuthCode is stored in the session cookie, an attacker who intercepts the encrypted session cookie can decrypt it locally using the public key and retrieve the AccessAuthCode in plain text, then take over the session.

SiYuan versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user with access to the import functionality in notes is able to overwrite any file on the system, and can escalate to full code execution under some circumstances. A fix is planned for version 3.5.0.