{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asiyuan_projectsiyuan/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:siyuan_project:siyuan:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-73054"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SiYuan kernel (\u003c 0.0.0-20260731131820-67bc300b6ea6)"],"_cs_severities":["high"],"_cs_tags":["web-application","websocket","rce-precursor","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["SiYuan"],"content_html":"\u003cp\u003eThe SiYuan kernel suffers from a parser differential vulnerability where the logic used to exempt WebSocket keepalive sessions from authentication matches raw substrings, while the logic used to quarantine those sessions parses the query string. By sending a crafted URI containing duplicated 'id' and 'type' keys, an attacker can satisfy the authentication exemption while tricking the quarantine logic, leading to the session being placed in the active broadcast pool rather than a quarantined state. This issue, tracked as CVE-2026-73054, allows unauthenticated remote callers to receive live event streams on instances configured with an access auth code.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to gain visibility into system metadata. Observed disclosed information includes document identifiers, document titles, notebook names, file paths, notebook child structures, and a real-time stream of create, update, and delete operations. Document body content is not currently confirmed to be exposed via this vector. The vulnerability also lacks origin validation, maintaining susceptibility to cross-origin attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the SiYuan kernel to version 0.0.0-20260731131820-67bc300b6ea6 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement request-level monitoring on the \u003ccode\u003e/ws\u003c/code\u003e WebSocket endpoint to identify and block requests containing duplicate query parameters.\u003c/li\u003e\n\u003cli\u003eAudit logs for WebSocket connections that establish session IDs associated with the broadcast pool while lacking valid session authentication tokens.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T21:48:55Z","date_published":"2026-10-23T21:48:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-siyuan-parser-differential/","summary":"A parser differential in the SiYuan kernel WebSocket implementation allows unauthenticated attackers to bypass authentication by using duplicated query parameters, granting unauthorized access to the live event stream.","title":"SiYuan Kernel: Unauthenticated event stream access via URI parser differential (CVE-2026-73054)","url":"https://feed.craftedsignal.io/briefs/2026-10-siyuan-parser-differential/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:siyuan_project:siyuan:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}