Live › vulnerability › GHSA-x8gv-g2g3-65fj
Go to dashboardSiYuan's Agent Tools in the kernel package have an SSRF flaw: a DNS-rebinding time-of-check/time-of-use race lets a request bypass the CheckHostSSRF host check. An attacker can make the server reach internal hosts it should not contact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260813142806-dd2778b70d02 | 0.0.0-20260813142806-dd2778b70d02 |
Run go list -m github.com/siyuan-note/siyuan/kernel to see the pinned pseudo-version.
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260813142806-dd2778b70d02 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernel
This page as .md · .json · in your agent: get_signal("GHSA-x8gv-g2g3-65fj")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.