Tag
SiYuan Publish-Mode Reader Configuration and Index Mutation Vulnerability
2 rules 1 TTPSiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs, leading to configuration changes, denial of service, data corruption, and information disclosure by manipulating cloud sync intervals, graph configurations, SQL block content, and recent-documents lists.
SiYuan Bazaar Marketplace Stored XSS Leads to Electron RCE
2 rules 1 TTPSiYuan's Bazaar marketplace is vulnerable to stored cross-site scripting (XSS) via unescaped package metadata, leading to arbitrary OS command execution in the desktop Electron client.
SiYuan Stored XSS via Attribute View Name Leads to Electron Renderer RCE (CVE-2026-44670)
2 rules 2 TTPsA stored cross-site scripting (XSS) vulnerability exists in SiYuan due to the kernel storing Attribute View (AV) names without HTML escaping, allowing a malicious actor to inject arbitrary HTML which leads to Node.js code execution due to insecure Electron configuration, resulting in remote code execution (RCE).
SiYuan Path Traversal via Double URL Encoding in `/export/` Endpoint
2 rules 1 TTP 1 CVE 1 IOCSiYuan is vulnerable to path traversal via double URL encoding in the `/export/` endpoint, bypassing an incomplete fix for CVE-2026-30869; an authenticated attacker can exploit this vulnerability to traverse directories and read arbitrary workspace files, including the SQLite database (`siyuan.db`), kernel log, and user documents due to a redundant `url.PathUnescape()` call in `serveExport()`.
SiYuan Zero-Click NTLM Theft and Blind SSRF via Mermaid Diagrams
2 rules 3 TTPs 1 CVESiYuan is vulnerable to zero-click NTLM hash theft on Windows and blind SSRF on all platforms due to insecure Mermaid.js configuration, where a malicious Mermaid diagram containing a protocol-relative URL can be injected into a note, causing the Electron client to fetch the URL, triggering SMB authentication on Windows and sending the victim's NTLMv2 hash to the attacker. On macOS and Linux, the request acts as a tracking pixel and blind SSRF.
SiYuan Note Reflected XSS Vulnerability in SVG Processing
2 rules 1 TTPSiYuan Note versions prior to the fix for commit f09953afc57a are vulnerable to reflected cross-site scripting (XSS) via a namespace prefix bypass in the SanitizeSVG function when handling dynamic icons, allowing unauthenticated attackers to execute arbitrary JavaScript in a victim's browser.
SiYuan Knowledge Management System RCE via Malicious Website
2 rules 1 TTP 1 CVESiYuan versions prior to 3.6.2 are vulnerable to remote code execution (RCE) via a malicious website exploiting a permissive CORS policy to inject a JavaScript snippet, leading to arbitrary code execution within the application's Node.js context.
SiYuan Note Taking Application Directory Traversal Vulnerability
2 rules 1 TTPSiYuan note taking application is vulnerable to a directory traversal via the /api/file/readDir endpoint, which does not require authentication, allowing an attacker to enumerate the directory structure and retrieve file names, potentially leading to arbitrary document reading.
SiYuan Arbitrary Document Reading Vulnerability in Publishing Service
2 rules 1 TTPSiYuan is vulnerable to arbitrary document reading via the publishing service, allowing attackers to retrieve document IDs and view the content of all documents, including encrypted or prohibited ones, by exploiting the `/api/file/readDir` and `/api/block/getChildBlocks` interfaces.