siyuan-note siyuan
Published Atomicorp research notes for CVEs affecting siyuan-note siyuan where WAF protections were observed during testing or engineering review.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
| CVE | Vulnerability | CVSS | Severity | Rules Observed |
|---|---|---|---|---|
| CVE-2026-69083 | SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69084 | SiYuan - SQL Execution | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344366 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69085 | SiYuan before v3.7.3 SQL Injection via searchDocs | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-66395 | SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol | 9.4 (v4.0) | Critical | 333140 , 340095 , 341266 |
| CVE-2026-73041 | SiYuan before v3.7.4 Remote Code Execution via PDF Annotations | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73042 | SiYuan before v3.7.4 Remote Code Execution via Menu Metadata | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-73043 | SiYuan before v3.7.4 Remote Code Execution via Template Calculation | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73044 | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73050 | SiYuan before v3.7.4 Stored XSS via select option color | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73052 | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73053 | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-77086 | SiYuan before v3.7.4 Path Traversal via packageName | 9.4 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-66394 | SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass | 9.3 (v4.0) | Critical | 300013 , 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-66396 | SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-74798 | SiYuan kernel Path Traversal via database_clean MCP tool | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-74902 | SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-87807 | siyuan before v3.8.2 SQL Injection via fullTextSearchBlock | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34605 | SiYuan Note - Cross-Site Scripting | 8.6 (v4.0) | High | 300013 |
| CVE-2026-84803 | SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist | 8.6 (v4.0) | High | 333140 , 333141 |
| CVE-2026-87811 | SiYuan before v3.8.2 Stored XSS via notebook template paths | 8.4 (v4.0) | High | 333140 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-87814 | SiYuan before v3.8.2 Stored XSS via Asset Preview | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-69086 | SiYuan before v3.7.3 Path Traversal via unvalidated avID | 8.3 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | 7.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59809 | SiYuan before v3.8.0 Secret Exfiltration via http_request URL | 6.9 (v4.0) | Medium | 337109 , 347009 , 390722 |
| CVE-2026-82233 | SiYuan before v3.8.1 Path Traversal via asset.upload | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-31807 | SiYuan <= v3.5.9 - SVG Animate Element XSS | 6.4 (v4.0) | Medium | 300013 |
| CVE-2026-31809 | SiYuan <= v3.5.9 - Cross Site Scripting | 6.4 (v4.0) | Medium | 300013 |
| CVE-2026-29183 | SiYuan Note - Cross-Site Scripting | 6.1 (v3.1) | Medium | 300013 , 340147 , 341266 , 347198 |
| CVE-2026-82650 | SiYuan before v3.8.1 Path Traversal via /api/template/render | 5.9 (v4.0) | Medium | 340007 , 344360 , 390709 |