CVE-2026-73054 · GHSA-c8w8-3pqp-wr83
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
- Risk score
- 69/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 15 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint. Unauthenticated attackers can craft a malicious WebSocket URI to bypass access auth code validation and receive the live kernel event stream.
- Affected
- {'products': ['SiYuan'], 'packages': [{'ecosystem': 'go', 'name': 'github.com/siyuan-note/siyuan/kernel', 'vulnerable': '< 0.0.0-20260731131820-67bc300b6ea6'}], 'versions': ['< v3.7.4']}
- Fix
- Upgrade to version 0.0.0-20260731131820-67bc300b6ea6 or later
- Exploitation
- Public proof of concept
Story map
At a glance
github.com/siyuan-note/siyuan/kernel: Red, act today. SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish …
The flaws
- CVE-2026-73054: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream (CVSS 7.5 · EPSS 1%)
- CVE-2026-69085: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking (CVSS 10.0 · EPSS 1%)
- GHSA-9cqf-hhrq-7v45: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route (CVSS 8.6)
- GHSA-x8gv-g2g3-65fj: SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) (CVSS 8.2)
The fix
Upgrade github.com/siyuan-note/siyuan/kernel: 3.7.4 · 3.7.3 or later on your release line
Who is exposed: github.com/siyuan-note/siyuan/kernel (go) < 0.0.0-20260721043339-eef10568384e
Where it stands
- Public proof of concept
Connects to
- Same weakness: Authentication bypass (CWE-287). 237 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260731131820-67bc300b6ea6 | 0.0.0-20260731131820-67bc300b6ea6 |
References
- https://github.com/advisories/GHSA-c8w8-3pqp-wr83
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8w8-3pqp-wr83
- https://nvd.nist.gov/vuln/detail/CVE-2026-73054
- https://github.com/siyuan-note/siyuan/commit/67bc300b6ea6650d99dae55c827aeced419c8ac4
- https://github.com/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.4
- https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-websocket
- https://github.com/advisories/GHSA-c8w8-3pqp-wr83
Original description
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.
Last activity 23 Oct 2026. Patch Forecast updates every hour.