Siyuan Note: 25 Vulnerabilities Including RCE and Auth Bypass Disclosed Together
Key findings • 25 vulnerabilities in Siyuan Note disclosed together, patched in v3.7.4. • Critical flaws include RCE, XSS, and authentication bypass, impacting core functionalities. • Wid…
Key findings
- 25 vulnerabilities in Siyuan Note disclosed together, patched in v3.7.4.
- Critical flaws include RCE, XSS, and authentication bypass, impacting core functionalities.
- Widespread failure to enforce publish-access controls across numerous API endpoints led to information disclosure.
- SQL injection and server-side template injection vulnerabilities also present.
- Users must update to v3.7.4 to mitigate severe security risks.
On August 15, 2026, a significant batch of 25 vulnerabilities was disclosed for Siyuan Note, a popular note-taking application. These vulnerabilities, all patched in version v3.7.4, primarily revolve around authentication bypass, information disclosure, and cross-site scripting (XSS) flaws, with several critical and high-severity issues allowing for remote code execution and unauthorized access to sensitive data. The disclosures span a three-day window from August 12 to August 15, 2026, highlighting a widespread failure to properly validate, sanitize, and authorize access across numerous API endpoints and application features.
Several critical vulnerabilities center on cross-site scripting (XSS) and remote code execution (RCE) possibilities. CVE-2026-73053 describes an XSS flaw in the unicode2Emoji function that, when combined with Node integration, could lead to arbitrary code execution. Similarly, CVE-2026-73052 details an XSS vulnerability in the sort menu where unescaped attribute-view field names allow for JavaScript execution. CVE-2026-73043 highlights an RCE vulnerability in the template calculation operator, which renders user-authored Go templates without sanitization, enabling attackers to inject malicious HTML and JavaScript. Further XSS risks are present in CVE-2026-73050, where unescaped color fields in attribute-view select options can lead to arbitrary JavaScript execution, and CVE-2026-73044, which involves stored XSS via unescaped table column width values. CVE-2026-73042 also presents an XSS risk through improperly escaped database menu metadata. CVE-2026-73041 details an RCE vulnerability where annotation fields are written to disk without proper escaping, allowing malicious markup to execute in the PDF renderer.
Authentication bypass and excessive authentication attempt vulnerabilities form another significant group. CVE-2026-73046, a critical flaw with a CVSS score of 9.8, details an improper restriction of excessive authentication attempts in the CheckAuth() middleware, allowing attackers to bypass workspace access code checks. CVE-2026-73045, a high-severity issue, permits brute-forcing of per-notebook publish passwords due to a lack of rate limiting or CAPTCHA on the authFilePublishAccess endpoint. CVE-2026-72809, another high-severity authentication bypass, grants administrator privileges to any request originating from localhost for specific endpoints. CVE-2026-73054 also describes an authentication bypass in the WebSocket endpoint due to differential parsing of query parameters.
A substantial number of vulnerabilities fall under information disclosure, often stemming from a failure to enforce publish-access controls. CVE-2026-73049, CVE-2026-73048, CVE-2026-73630, CVE-2026-73609, CVE-2026-73608, CVE-2026-73607, and CVE-2026-73606 all relate to API endpoints that leak sensitive information, such as document identifiers, block identifiers, outline states, or bookmark labels, without proper authorization checks. CVE-2026-73605 is a path traversal vulnerability allowing anonymous readers to probe filesystem existence. CVE-2026-72808 also involves information disclosure via an endpoint that returns PDF annotation file content without a publish-access check. CVE-2026-73610 discloses local storage information, including private document identifiers and search keywords, due to insufficient sanitization.
The batch also includes a critical SQL injection vulnerability, CVE-2026-72811, found in the backlink/mention search query where insufficient escaping of user-supplied keywords allows for SQL injection. Additionally, CVE-2026-73047 introduces a server-side template injection vulnerability in the attribute-view template calculation feature, exposing sensitive functions like env and expandenv. CVE-2026-72812, a medium-severity flaw, involves missing authorization on the /api/ref/refreshBacklink endpoint, allowing anonymous readers to trigger server-side writes and flush transaction queues. CVE-2026-72810 involves a publish-boundary bypass in WebSocket broadcast sessions, allowing anonymous readers to receive unfiltered edits.
All disclosed vulnerabilities were patched in Siyuan Note version v3.7.4. Users are strongly advised to update to this version to mitigate the risks associated with these critical security flaws, including potential remote code execution, unauthorized data access, and system compromise. The widespread nature of these vulnerabilities underscores the importance of rigorous security testing and code review for applications handling sensitive user data.
This extensive disclosure, impacting numerous API endpoints and core functionalities, highlights critical security oversights in Siyuan Note prior to version v3.7.4. The vulnerabilities range from severe remote code execution and authentication bypass to widespread information disclosure due to inadequate access controls. Users of Siyuan Note should prioritize updating to version v3.7.4, which addresses all these issues. Continued vigilance and prompt patching are essential for maintaining the security and integrity of user data within the application. The sheer volume and severity of these CVEs indicate a significant security posture improvement is necessary for the product.