Live › vulnerability › GHSA-hg5w-8ppq-wpjq
Go to dashboardSiYuan's WebSocket endpoint parses duplicated query parameters differently in its auth-exemption check than in its session quarantine check, so an unauthenticated attacker can receive the live kernel event stream, including document IDs, titles and operation logs. This advisory is withdrawn as a duplicate of GHSA-c8w8-3pqp-wr83, which covers the same flaw.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 3.7.4 | – |
Unknown from the sources.
Upgrade SiYuan to v3.7.4 or later, or follow GHSA-c8w8-3pqp-wr83 which is the maintained advisory for this issue.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-c8w8-3pqp-wr83. This link is maintained to preserve external references.
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.
This page as .md · .json · in your agent: get_signal("GHSA-hg5w-8ppq-wpjq")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.