Security: siyuan-note/siyuan
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfoGHSA-74pj-6g7r-j55c published
Jul 26, 2026 by 88250Moderate -
Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews (pre-release)GHSA-57v5-wqx3-cgj4 published
Jul 26, 2026 by 88250Moderate -
Tag labels from password-protected documents are returned to readers who have not entered the password (publish mode)GHSA-mp7r-57w4-5qm3 published
Jul 26, 2026 by 88250Moderate -
The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConfGHSA-34fj-mwm6-fjfg published
Jul 25, 2026 by 88250High -
Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers (publish mode)GHSA-h6w7-xxcf-w2mq published
Jul 25, 2026 by 88250High -
Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers (publish mode)GHSA-fgmr-7w36-9qfq published
Jul 25, 2026 by 88250Moderate -
getEncryptedNotebookStatus discloses names and live unlock state of all encrypted notebooks to anonymous readers (publish mode)GHSA-f2rw-w22v-54vh published
Jul 24, 2026 by 88250Moderate -
Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns (publish mode)GHSA-mfrj-v65r-979c published
Jul 24, 2026 by 88250High -
Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers (publish mode)GHSA-5w7r-f4cg-rqq7 published
Jul 24, 2026 by 88250Moderate