SiYuan before v3.7.4 SQL Injection via backlink search

SiYuan before v3.7.3 SQL Injection via searchDocs

SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token

SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

SiYuan before v3.7.2 Cross-Site Scripting to RCE

SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute

SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan

SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS

SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

SiYuan before v3.7.4 Path Traversal via packageName

SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

SiYuan has an arbitrary file deletion vulnerability

SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.7.4 Stored XSS via assets endpoint

SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji

SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names

SiYuan before v3.7.4 Stored XSS via select option color

SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width

SiYuan before v3.7.4 Remote Code Execution via Template Calculation

SiYuan before v3.7.4 Remote Code Execution via Menu Metadata

SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)

SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client

SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

SiYuan before v3.8.1 Stored XSS via block name

SiYuan before v3.8.1 Stored XSS via confirmDialog

SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

SiYuan through 3.8.4 Stored XSS via notebook names

SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before v3.8.2 TLS Private Key Disclosure via getFile