SiYuan before v3.8.1 Stored XSS via block name

SiYuan before v3.8.1 Stored XSS via confirmDialog

SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

SiYuan through 3.8.4 Stored XSS via notebook names

SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

SiYuan before v3.8.2 API Token Exposure via Log File

SiYuan Desktop Notification XSS Leads to Electron RCE

SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access

SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

SiYuan before v3.8.2 Path Traversal via removeRiffDeck

SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

SiYuan kernel Path Traversal via database_clean MCP tool

SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass

SiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client

SiYuan before v3.7.4 XSS-to-RCE via pathName.ts

SiYuan XSS-to-RCE via unescaped block metadata in hint popup

SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket

SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget

SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints

SiYuan before v3.7.4 Information Disclosure via renderAttributeView

SiYuan before v3.7.4 Information Disclosure via Embed Block

siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

SiYuan before v3.7.4 Information Disclosure via /api/system/getConf

SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks

SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction

SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc

SiYuan before v3.7.3 Authentication Bypass via Content Endpoints

SiYuan: Store XSS To Rce via Asset.render

SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL

SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution

SiYuan has a Full-Read SSRF via /api/network/forwardProxy

SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU

SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy

SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe

SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution

SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API

SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret

SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

SiYuan before v3.8.4 Stored XSS via Attribute View textarea

SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content

SiYuan before v3.7.4 Authentication Bypass via Localhost Trust

SiYuan before v3.7.4 SQL Injection via queryBlocks template