Go - OSV

GHSA-5fhr-f75j-8wr9

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) 18 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-8x84-r2ff-h8pq

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking 18 hours ago

Fix available
Severity - 7.5 (High)

GHSA-jv8v-xq2h-657v

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath 18 hours ago

Fix available
Severity - 5.3 (Medium)

GHSA-qvq9-hq6p-v378

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents 18 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-vpjw-wf5h-cgpq

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents 18 hours ago

Fix available
Severity - 8.6 (High)

GHSA-67x2-mq63-v9vm

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents 18 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-6mcf-g667-w3qv

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) 19 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-x67c-8pwr-m8g3

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel 19 hours ago

Fix available
Severity - 8.0 (High)

GHSA-v7ph-r5r6-4jcj

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode) 19 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-3mp7-4rh5-jrv9

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy 19 hours ago

Fix available
Severity - 8.0 (High)

GHSA-mw8r-mw84-88v2

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode) 19 hours ago

Fix available
Severity - 8.6 (High)

GHSA-q2vg-7qgx-x5fc

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle 19 hours ago

Fix available
Severity - 10.0 (Critical)

GHSA-wgwx-479j-23vq

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) 19 hours ago

Fix available
Severity - 6.5 (Medium)

GHSA-7j72-f6wg-cxw6

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode) 20 hours ago

Fix available
Severity - 8.6 (High)

GHSA-pm3w-vxp9-ccwc

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered 20 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-36v8-mpjm-8j5r

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered 20 hours ago

Fix available
Severity - 8.6 (High)

Vulnerabilities