ZDF
Sign inSign up

Vulnerabilities

Security fix · GHSA-xp3q-r38w-vgqm

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

Published Oct 23, 2026 · catalog updated Oct 23, 2026 · SiYuan: The publish filter

Last checked Oct 24, 2026, 12 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-xp3q-r38w-vgqm. A missing EPSS score is not a low risk. Compare SiYuan: The publish filter with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (SiYuan: The publish filter).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Medium5.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Version ranges on file
Affected products
Go github.com/siyuan-note/siyuan/kernel · go github.com/siyuan-note/siyuan/kernel

### Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit resolved it by removing and nulling for readers. That fix is correct and complete for the live layout. This report concerns a different endpoint, a different filter function and a different storage backing. reads rather than , and its filter was not touched by that commit. The consequence is that the same serialized tab objects the earlier fix withheld continue to be served, from the closed-tab history rather than the live layout. ### Summary Three routes, , and , are registered with only and are reachable by the publish token and anonymously when is . All three call and then, for read-only roles, . That filter begins by assigning the administrator's entire storage map to its return value and then removes three specific fields. Everything else in the map is returned unmodified. A single unauthenticated POST with an empty body returns the administrator's recently closed tabs with their document titles and identifiers, their current search keywords and the paths those searches cover, the expanded private paths in their file tree, and per-document identifiers from several other keys. ### Details **Routes.** on master, the same block on the development branch: No , no . **The filter is an allowlist inverted into a blocklist.** on master and on the development branch, byte-identical on both: holds roughly thirty keys. Three are sanitized. The rest are returned as stored. **What survives.** Taking the client's own list of keys it round-trips through this endpoint ( ), the notable survivors are: - . Up to entries, each produced by at . This is the same serializer that produced the data in the earlier advisory: tab title, , , , , , , and for a Search tab the entire config object. Unfiltered. - . The live document-search configuration, including (the search text), (replace text), , (the paths the search was scoped to) and . Note the filter clears the search *history

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/siyuan-note/siyuan/kernel0 → 0.0.0-20260729005258-4daee87d4152
  • go github.com/siyuan-note/siyuan/kernel< 0.0.0-20260729005258-4daee87d4152

How to fix GHSA-xp3q-r38w-vgqm

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for GHSA-xp3q-r38w-vgqm. A missing EPSS score is not a low risk. Compare SiYuan: The publish filter with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 0.0.0-20260729005258-4daee87d4152, < 0.0.0-20260729005258-4daee87d4152. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 23, 2026 · GitHub Advisory Database

    Detected

    ### Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit resolved it by removing and nulling for readers. That fix is correct and complete for the live layout. This report concerns a different endpoint, a different filter function and a different storage backing. reads rather than , and its filter was not touched by that commit. The consequence

  2. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    github.com/siyuan-note/siyuan/kernel fixed in 0.0.0-20260729005258-4daee87d4152

  3. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    github.com/siyuan-note/siyuan/kernel fixed in 0.0.0-20260729005258-4daee87d4152

  4. Oct 23, 2026 · GitHub Advisory Database

    Updated

    ### Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit resolved it by removing and nulling for readers. That fix is correct and complete for the live layout. This report concerns a different endpoint, a different filter function and a different storage backing. reads rather than , and its filter was not touched by that commit. The consequence

Sources

  • GitHub Advisory DatabasePackage advisoryGHSA-xp3q-r38w-vgqm

    SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

    github.com
  • Go Vulnerability DatabasePackage advisoryGHSA-xp3q-r38w-vgqm

    SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-xp3q-r38w-vgqm

    SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

    osv.dev

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Go Vulnerability DatabaseOct 24, 2026
  • GitHub Advisory DatabaseOct 23, 2026
  • OpenSSF OSV / OSV ScannerOct 23, 2026