What’s Vulnerable › Vulnerabilities

CVE-2026-54069: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

• Severity: critical (CVSS 9.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-24 · updated 2026-10-25
• Weakness: CWE-346

Description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0.

Affected products

• siyuan-note siyuan: before 3.7.0

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3

Get alerted when CVE-2026-54069 or the next vulnerability affects your stack