---
id: "CVE-2026-74802"
kind: "vulnerability"
aliases: ["CVE-2026-74802", "GHSA-3cc2-h3v6-rqpq", "GO-2026-6650"]
title: "SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernel"
severity: "high"
cvss: 8.2
epss: 0.00164
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/siyuan-note/siyuan/kernel", "fixed": ["0.0.0-20260803045322-cb67e0b4fab5"], "affected": "< 0.0.0-20260803045322-cb67e0b4fab5", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["desktop", "go", "package", "self-hosted", "siyuan"]
not_affected_if: ["no-browser-session-on-host", "version-3.7.4-or-later"]
published_at: "2026-08-17T11:16:40+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:44:14+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6650", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-74802", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74802", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernel

SiYuan versions before 3.7.4 have an admin-only WebSocket endpoint, /ws/network/proxy, that disables origin checks, so any webpage the user opens can connect to it. An attacker's page can then make the SiYuan kernel proxy arbitrary network traffic to targets they choose, pivoting through the victim's machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/siyuan-note/siyuan/kernel affected < 0.0.0-20260803045322-cb67e0b4fab5 fixed 0.0.0-20260803045322-cb67e0b4fab5

## How to check

Check the installed SiYuan version and confirm it is 3.7.4 or later.
For the Go module, check that github.com/siyuan-note/siyuan/kernel is at 0.0.0-20260803045322-cb67e0b4fab5 or later.

## Fix

Upgrade SiYuan to 3.7.4 or later, or to commit cb67e0b4fab5 or later for the Go module.
Until then, avoid browsing untrusted sites while SiYuan is running.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6650
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-74802
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-74802

## From the sources

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_