Live › vulnerability › GHSA-9cqf-hhrq-7v45
Go to dashboardSiYuan's getAttributeViewSearchTarget endpoint in the kernel Go module returns database row content to anonymous readers because it skips the publish-access check. An unauthenticated visitor of a published SiYuan instance can read database content that should be private.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | >= 0.0.0-20260726161145-9b8e8956f997, < 0.0.0-20260812083335-251596fc0de2 | 0.0.0-20260812083335-251596fc0de2 |
Unknown from the sources.
Update github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260812083335-251596fc0de2 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel
This page as .md · .json · in your agent: get_signal("GHSA-9cqf-hhrq-7v45")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.