CVE-2026-59809 SiYuan before v3.8.0 Secret Exfiltration via http_request URL

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...

EUVD-2026-64267

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...

CVE-2026-59809: Insertion of Sensitive Information Into Sent Data

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...