Go Modules

github.com/siyuan-note/siyuan/kernel Known Vulnerabilities & Fixes

github.com/siyuan-note/siyuan/kernel has 37 known security vulnerabilities in Go Modules. Upgrade to version 3.6.40.0.0-20260407035653-2f416e5253f1 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.

37 Vulnerabilities

Low Immediate Risk

No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.

Recommended safe version: 3.6.40.0.0-20260407035653-2f416e5253f1

Upgrading to 3.6.40.0.0-20260407035653-2f416e5253f1 or later resolves all 37 known vulnerabilities in github.com/siyuan-note/siyuan/kernel. Run: go get github.com/siyuan-note/siyuan/kernel@v3.6.40.0.0-20260407035653-2f416e5253f1

Is github.com/siyuan-note/siyuan/kernel in your project?

Check if you're affected and upgrade to 3.6.40.0.0-20260407035653-2f416e5253f1 to stay secure.

Start Free Scan Get Alerted When New CVEs Drop

Total

Critical

High

Medium

Low

Security Summary

38 affected version ranges have been identified across these 37 advisories.
81% of known issues have a published fixed version.
Remediation: go get -u github.com/siyuan-note/siyuan/kernel

Vulnerabilities

37 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Jan 29, 2026, most recently Oct 1, 2026 (245 days apart).

CVE / GHSA	Severity	CVSS	EPSS	Summary	Affected	Fixed In
CVE-2026-69085 SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking	CRITICAL	10.0	—	SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking	All versions	0.0.0-20260721043339-eef10568384e
CVE-2026-72811 SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle	CRITICAL	10.0	—	SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle	All versions	0.0.0-20260723004839-1a5b3431d5ab
CVE-2026-69083 SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB	CRITICAL	10.0	—	SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB	All versions	0.0.0-20260721004815-cf42dd5680c8
CVE-2026-69084 SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write	CRITICAL	10.0	—	SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write	All versions	0.0.0-20260721002947-23a17d44b5f3
CVE-2026-50551 SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content	CRITICAL	9.9	—	SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content	All versions	0.0.0-20260628153353-2d5d72223df4
CVE-2026-54158 SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()	CRITICAL	9.9	—	SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()	All versions	0.0.0-20260628153353-2d5d72223df4
CVE-2026-54067 SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()	CRITICAL	9.9	—	SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()	All versions	0.0.0-20260628153353-2d5d72223df4
CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service	CRITICAL	9.8	—	SiYuan has Arbitrary Document Reading within the Publishing Service	All versions	No fix available
CVE-2026-32938 SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service	CRITICAL	9.9	—	SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service	All versions	No fix available
CVE-2026-33670 SiYuan has directory traversal within its publishing service	CRITICAL	9.8	—	SiYuan has directory traversal within its publishing service	All versions	No fix available
CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API	CRITICAL	9.8	—	SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API	All versions	No fix available
CVE-2026-44670 SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE	CRITICAL	9.6	—	SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE	All versions	0.0.0-20260512140701-d7b77d945e0d
CVE-2026-34449 SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection	CRITICAL	9.6	—	SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection	All versions	3.6.2
CVE-2026-30869 SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage	CRITICAL	9.3	—	SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage	All versions	3.5.10
CVE-2026-29183 SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint	CRITICAL	9.3	—	SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint	All versions	0.0.0-20260304034809-d68bd5a79391
CVE-2026-44588 SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)	CRITICAL	9.1	—	SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)	All versions	No fix available
CVE-2026-45375 SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution	CRITICAL	9.0	—	SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution	All versions	No fix available
CVE-2026-25539 SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE	CRITICAL	9.1	—	SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE	All versions	No fix available
CVE-2026-39846 SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions	CRITICAL	9.0	—	SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions	All versions	0.0.0-20260407035653-2f416e5253f1
CVE-2026-34448 SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client	CRITICAL	9.0	—	SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client	All versions	3.6.2
CVE-2026-40318 SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`	HIGH	8.5	—	SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`	All versions	3.6.40.0.0-20260407035653-2f416e5253f1
CVE-2026-66394 SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass	HIGH	8.7	—	SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass	All versions	0.0.0-20260714095344-f08dee71ba8e
CVE-2026-72789 SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked	HIGH	8.6	—	SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked	All versions	0.0.0-20260726020813-a25c2dd06aae
CVE-2026-72793 SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers	HIGH	8.6	—	SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers	All versions	0.0.0-20260725132049-2d8b98395a91
CVE-2026-72795 SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers	HIGH	8.6	—	SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers	All versions	0.0.0-20260725125659-1ca1c3c9d94b
CVE-2026-72794 SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf	HIGH	8.6	—	SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf	All versions	0.0.0-20260725123945-77421530be4a
CVE-2026-72798 SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns	HIGH	8.6	—	SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns	All versions	0.0.0-20260724121519-426991d155c0
CVE-2026-72804 SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents	HIGH	8.6	—	SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents	All versions	0.0.0-20260724091654-82e9ded423e4
CVE-2026-72810 SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)	HIGH	8.6	—	SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)	All versions	0.0.0-20260723013612-ba948639d7f6
CVE-2026-68584 SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)	HIGH	8.6	—	SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)	All versions	0.0.0-20260721020826-2d069dce84a2
CVE-2026-68586 SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered	HIGH	8.6	—	SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered	All versions	0.0.0-20260721014413-f45749a7ef6e
CVE-2026-68587 SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check	HIGH	8.6	—	SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check	All versions	0.0.0-20260721013353-69db783b782a
CVE-2026-40107 SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering	HIGH	8.6	—	SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering	All versions	0.0.0-20260407035653-2f416e5253f1
CVE-2026-34585 SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution	HIGH	8.6	—	SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution	All versions	0.0.0-20260329142331-918d1bd9f967
CVE-2026-32110 SiYuan has a Full-Read SSRF via /api/network/forwardProxy	HIGH	8.3	—	SiYuan has a Full-Read SSRF via /api/network/forwardProxy	All versions	3.6.0
CVE-2026-31809 SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS	MEDIUM	9.3	—	SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS	All versions	0.0.0-20260310025236-297bd526708f
CVE-2026-31807 SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS	MEDIUM	9.3	—	SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS	All versions	0.0.0-20260310025236-297bd526708f

About This Data

Vulnerability data for github.com/siyuan-note/siyuan/kernel is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.

CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Related Go Modules Packages

Other packages in this ecosystem, ranked by shared vulnerabilities where available.

github.com/rancher/rancher github.com/traefik/traefik/v3 gogs.io/gogs code.gitea.io/gitea github.com/mattermost/mattermost-server github.com/mattermost/mattermost/server/v8 github.com/traefik/traefik/v2 github.com/zitadel/zitadel

Check Your Dependencies

Scan your project to check if you're using a vulnerable version of github.com/siyuan-note/siyuan/kernel.

Start Free Scan Create Free Account

Data from OSV DatabaseUpdated daily200K+ vulnerabilities indexed