github.com/siyuan-note/siyuan/kernel vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-50551Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentCVE-2026-54158Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()CVE-2026-54070Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Stored XSS in Bazaar marketplace via package README event handlersCVE-2026-54069Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin AllowlistCVE-2026-54068Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIconCVE-2026-54067Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()CVE-2026-54066Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894 CVE-2026-45375Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionCVE-2026-45371Highgithub.com/siyuan-note/siyuan/kernel: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIsCVE-2026-45148Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-modeCVE-2026-45147Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to diskCVE-2026-44588Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)CVE-2026-44670Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCECVE-2026-41894Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)CVE-2026-40922Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan has incomplete fix for CVE-2026-33066: XSSCVE-2026-40318Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`CVE-2026-40259Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView`CVE-2026-40107Highgithub.com/siyuan-note/siyuan/kernel: SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram RenderingCVE-2026-39846Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captionsCVE-2026-34605Highgithub.com/siyuan-note/siyuan/kernel: SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated)CVE-2026-34585Highgithub.com/siyuan-note/siyuan/kernel: SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command executionCVE-2026-34453Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmarkCVE-2026-34449Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet InjectionCVE-2026-34448Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop ClientCVE-2026-33670Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan has directory traversal within its publishing service

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo