Siyuan

This hub aggregates every CVE we track for Siyuan, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Siyuan.

• CVE-2026-56397SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README9.6Jun 21, 2026
• CVE-2026-56395SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README9.6Jun 21, 2026
• CVE-2026-45147SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk4.3May 14, 2026
• CVE-2026-45148SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata4.3May 14, 2026
• CVE-2026-45375SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution9.0May 14, 2026
• CVE-2026-44586SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution8.3May 14, 2026
• CVE-2026-41421SiYuan Desktop Notification XSS Leads to Electron RCE8.8Apr 24, 2026
• CVE-2026-40922SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)5.4Apr 16, 2026
• CVE-2026-40322SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE9.0Apr 16, 2026
• CVE-2026-40318SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`8.5Apr 16, 2026
• CVE-2026-40259SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API8.1Apr 16, 2026
• CVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering6.5Apr 9, 2026
• CVE-2026-39846SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions9.0Apr 7, 2026
• CVE-2026-34605SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )6.1Mar 31, 2026
• CVE-2026-34585SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution8.6Mar 31, 2026