CVE-2024-55660

🗓️ 11 Dec 2024 22:54:52Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 124 Views🌐 WEB

SiYuan prior to 3.1.16 has Server-Side Template Injection vulnerability in its endpoint.

Reporter	Title	Published	Views	Family All 30
Circl	CVE-2024-55660	12 Dec 202401:14	–	circl
CNNVD	SiYuan 安全漏洞	12 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-55660 SiYuan has an SSTI via /api/template/renderSprig	11 Dec 202422:54	–	cvelist
EUVD	EUVD-2024-3426	3 Oct 202520:07	–	euvd
Github Security Blog	SiYuan has an SSTI via /api/template/renderSprig	11 Dec 202418:44	–	github
NVD	CVE-2024-55660	12 Dec 202402:15	–	nvd
OPENSUSE Linux	govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media (moderate)	19 Dec 202400:00	–	opensuse
OSV	GHSA-4PJC-PWGQ-Q9JP SiYuan has an SSTI via /api/template/renderSprig	11 Dec 202418:44	–	osv
OSV	GO-2024-3324 SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel	12 Dec 202415:46	–	osv
OSV	OPENSUSE-SU-2024:14599-1 govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media	18 Dec 202400:00	–	osv

NVD

Node

b3log siyuanMatch3.1.15-

[
  {
    "vendor": "siyuan-note",
    "product": "siyuan",
    "versions": [
      {
        "version": "< 3.1.16",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjc-pwgq-q9jp
github	www.github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71

Parameter	Position	Path	Description	CWE
template	request body	/api/template/renderSprig	Server-Side Template Injection (SSTI) in Sprig engine allows access to environment variables via the vulnerable /api/template/renderSprig endpoint (pre-3.1.16).	CWE-94, CWE-1336

17 Jun 2026 08:11Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.8

CVSS 46.9

EPSS0.00619

SSVC