CVE-2026-92986

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

EUVD-2026-81623

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986

SiYuan before 3.8.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the backlink dock tree , where document titles are rendered as HTML without escaping markup characters. An attacker can set a malicious title via the rename API or crafted notebooks, executing scripts in the Electron...

GO-2026-6402 SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle in github.com/siyuan-note/siyuan/kernel...

EUVD-2026-58626

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle...

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...

GHSA-Q2VG-7QGX-X5FC SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...

EUVD-2026-52274

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc publish mode: reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered...

GHSA-36V8-MPJM-8J5R SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

CVE: This vulnerability corresponds to CVE-2026-68586. Summary The backlink API splits into list endpoints which documents reference a block and content endpoints the rendered text of those referencing blocks. The list endpoints apply a publish-access filter, the content endpoints do not. As a...

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

CVE: This vulnerability corresponds to CVE-2026-68586. Summary The backlink API splits into list endpoints which documents reference a block and content endpoints the rendered text of those referencing blocks. The list endpoints apply a publish-access filter, the content endpoints do not. As a...

CVE-2026-82654

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2026-82654

SiYuan before v3.8.1 is affected by a Stored XSS caused by improper escaping of block name , alias , and memo fields in hint, backlink, and breadcrumb rendering functions. An attacker can set a block's name to contain HTML or script tags that execute when another user views a document referencing...

Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q2vg-7qgx-x5fc. This link is maintained to preserve external references. Original Description SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query...

CVE-2026-72811

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

CVE-2026-72811 SiYuan before v3.7.4 SQL Injection via backlink search

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

PT-2026-71981

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A SQL injection issue exists in the backlink/mention search query within kernel/model/backlink.go. The application concatenates stored block metadata title, name, alias, anchor text and a...

OPENSUSE-SU-2026:21567-1 Security update for zk

This update for zk fixes the following issues: Changes in zk: - Update to version 0.15.6: Parse links to notes in frontmatter Set filters for lsp completion items from the config Set a note's modification time in frontmatter and allow for custom key naming for both creation and modification keys...

Duplicate Advisory: SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-36v8-mpjm-8j5r. This link is maintained to preserve external references. Original Description SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content...