CVE-2026-126393 · Package
NO FIX YET · SEE WHAT TO DO
SiYuan's skill-install download path checks the hostname only when parsing the URL, so redirects or DNS rebinding can send requests to loopback addresses. An attacker who can submit a skill URL through the MCP skill install action can reach internal services and cloud metadata endpoints.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run SiYuan with its MCP skill install action reachable, especially on servers that can reach internal services or cloud metadata endpoints. Single-user desktop installs without MCP exposure are less exposed. unknown whether other configurations are affected.
Not affected if mcp-disabled, siyuan-3.8.10-or-later
Who cares mcp, self-hosted, siyuan
3.8.103.8.10 or laterSiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebinds to loopback addresses, reaching internal services and metadata endpoints.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.