CVE-2026-105205

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

CVE-2026-105205 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

CVE-2026-105205

The SiYuan note-taking application (versions prior to 3.8.5 ) is vulnerable to an information disclosure vulnerability. An attacker can bypass the publish confidentiality boundary by sending POST requests to the /api/block/getDocInfo or getDocsInfo endpoints for a published document. This allows ...

CVE-2026-105205 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

SUSE CVE-2026-72811

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

CVE-2026-92986

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

EUVD-2026-81623

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986

SiYuan before 3.8.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the backlink dock tree , where document titles are rendered as HTML without escaping markup characters. An attacker can set a malicious title via the rename API or crafted notebooks, executing scripts in the Electron...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986: Improper Neutralization of Input During Web Page Generation

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

PT-2026-94359

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description The software renders document titles as HTML in the backlink dock tree without escaping markup characters. This allows attackers to set malicious titles via the rename API or crafted notebooks to...

GO-2026-6402 SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle in github.com/siyuan-note/siyuan/kernel...

GHSA-Q2VG-7QGX-X5FC SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...

EUVD-2026-58626

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle...

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

CVE: This vulnerability corresponds to CVE-2026-68586. Summary The backlink API splits into list endpoints which documents reference a block and content endpoints the rendered text of those referencing blocks. The list endpoints apply a publish-access filter, the content endpoints do not. As a...

EUVD-2026-52274

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc publish mode: reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered...

GHSA-36V8-MPJM-8J5R SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

CVE: This vulnerability corresponds to CVE-2026-68586. Summary The backlink API splits into list endpoints which documents reference a block and content endpoints the rendered text of those referencing blocks. The list endpoints apply a publish-access filter, the content endpoints do not. As a...