siyuan-note siyuan
Published Atomicorp research notes for CVEs affecting siyuan-note siyuan where WAF protections were observed during testing or engineering review.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
| CVE | Vulnerability | CVSS | Severity | Rules Observed |
|---|---|---|---|---|
| CVE-2026-50551 | SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content | 9.9 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54067 | SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() | 9.9 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-69083 | SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69084 | SiYuan - SQL Execution | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344366 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69085 | SiYuan before v3.7.3 SQL Injection via searchDocs | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-66395 | SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol | 9.4 (v4.0) | Critical | 333140 , 340095 , 341266 |
| CVE-2026-73041 | SiYuan before v3.7.4 Remote Code Execution via PDF Annotations | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73042 | SiYuan before v3.7.4 Remote Code Execution via Menu Metadata | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-73043 | SiYuan before v3.7.4 Remote Code Execution via Template Calculation | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73044 | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73050 | SiYuan before v3.7.4 Stored XSS via select option color | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73052 | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73053 | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-77086 | SiYuan before v3.7.4 Path Traversal via packageName | 9.4 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-66394 | SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass | 9.3 (v4.0) | Critical | 300013 , 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-66396 | SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-74798 | SiYuan kernel Path Traversal via database_clean MCP tool | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-74902 | SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55570 | SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped data-obj attribute (Bypass for CVE-2026 | 9.0 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-100644 | SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116171 | SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-87807 | siyuan before v3.8.2 SQL Injection via fullTextSearchBlock | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100645 | SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban | 8.6 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34605 | SiYuan Note - Cross-Site Scripting | 8.6 (v4.0) | High | 300013 |
| CVE-2026-84803 | SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist | 8.6 (v4.0) | High | 333140 , 333141 |
| CVE-2026-92985 | SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels | 8.6 (v4.0) | High | 333140 , 333141 , 334168 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-92986 | SiYuan before 3.8.4 Cross-Site Scripting via Document Title | 8.6 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100643 | SiYuan before v3.8.4 Stored XSS via Attribute View textarea | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-87811 | SiYuan before v3.8.2 Stored XSS via notebook template paths | 8.4 (v4.0) | High | 333140 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-87814 | SiYuan before v3.8.2 Stored XSS via Asset Preview | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-69086 | SiYuan before v3.7.3 Path Traversal via unvalidated avID | 8.3 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-116167 | SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter | 7.6 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59834 | SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | 7.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-93591 | SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go | 7.2 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101091 | SiYuan before v3.8.4 SQL Injection via Block Query Embed | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-109309 | SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-116168 | SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-59809 | SiYuan before v3.8.0 Secret Exfiltration via http_request URL | 6.9 (v4.0) | Medium | 337109 , 347009 , 390722 |
| CVE-2026-82233 | SiYuan before v3.8.1 Path Traversal via asset.upload | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-31807 | SiYuan <= v3.5.9 - SVG Animate Element XSS | 6.4 (v4.0) | Medium | 300013 |
| CVE-2026-31809 | SiYuan <= v3.5.9 - Cross Site Scripting | 6.4 (v4.0) | Medium | 300013 |
| CVE-2026-29183 | SiYuan Note - Cross-Site Scripting | 6.1 (v3.1) | Medium | 300013 , 340147 , 341266 , 347198 |
| CVE-2026-82650 | SiYuan before v3.8.1 Path Traversal via /api/template/render | 5.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-116169 | SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |