PkgSeer

Vulnerability GO-2026-6831

Unknown

9 hours ago

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260731131820-67bc300b6ea6

Summary

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream in github.com/siyuan-note/siyuan/kernel

Details

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream in github.com/siyuan-note/siyuan/kernel

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260808051406-3542530c505f GO-2026-6863

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260731093152-c7522b8db586 GO-2026-6828

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260730150429-5b42614311b0 GO-2026-6833

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260808010544-26ccb40d390e GO-2026-6834

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260729005258-4daee87d4152 GO-2026-6836

View all vulnerabilities for these packages

Impacted packages

github.com/siyuan-note/siyuan/kernel

Timeline

Published

9 hours ago

Fixed (v0.0.0-20260731131820-67bc300b6ea6)

3 months ago

Last Modified

8 hours ago