CVE-2026-105205

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

CVE-2026-105205

The SiYuan note-taking application (versions prior to 3.8.5 ) is vulnerable to an information disclosure vulnerability. An attacker can bypass the publish confidentiality boundary by sending POST requests to the /api/block/getDocInfo or getDocsInfo endpoints for a published document. This allows ...

SUSE CVE-2026-72811

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

CVE-2026-92986

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

EUVD-2026-81623

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986

SiYuan before 3.8.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the backlink dock tree , where document titles are rendered as HTML without escaping markup characters. An attacker can set a malicious title via the rename API or crafted notebooks, executing scripts in the Electron...

CVE-2026-92986: Improper Neutralization of Input During Web Page Generation

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

GO-2026-6402 SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle in github.com/siyuan-note/siyuan/kernel...

EUVD-2026-58626

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle...

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...

GHSA-Q2VG-7QGX-X5FC SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...

EUVD-2026-52274

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc publish mode: reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered...

GHSA-36V8-MPJM-8J5R SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

CVE: This vulnerability corresponds to CVE-2026-68586. Summary The backlink API splits into list endpoints which documents reference a block and content endpoints the rendered text of those referencing blocks. The list endpoints apply a publish-access filter, the content endpoints do not. As a...

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

CVE: This vulnerability corresponds to CVE-2026-68586. Summary The backlink API splits into list endpoints which documents reference a block and content endpoints the rendered text of those referencing blocks. The list endpoints apply a publish-access filter, the content endpoints do not. As a...

CVE-2026-82654

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2026-82654

SiYuan before v3.8.1 is affected by a Stored XSS caused by improper escaping of block name , alias , and memo fields in hint, backlink, and breadcrumb rendering functions. An attacker can set a block's name to contain HTML or script tags that execute when another user views a document referencing...

CVE-2026-82654: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q2vg-7qgx-x5fc. This link is maintained to preserve external references. Original Description SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query...