Zero Radar
← feed
HighVulnerabilityCVE-2026-73054updated 25 Oct 2026, 13:32 UTC

SiYuan notes app lets unauthenticated users receive live updates over WebSocket

A flaw in SiYuan's live-connection check lets someone who is not logged in connect and receive the app's real-time data stream. The access code you set does not stop them.

Fixed in 0.0.0-20260731131820-67bc300b6ea6Official source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes0.0.0-20260731131820-67bc300b6ea6 · since 25 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends crafted requestRepeated id and type keys in WebSocket URI
  2. 2Exemption check passesRaw substring match skips authentication
  3. 3Session treated as normalFirst parsed value is main, not auth
  4. 4Joins broadcast poolReceives live event stream
  5. ResultAttacker reads live event stream

What happened

The kernel WebSocket authentication exemption matches raw URI substrings, while the quarantine for exempted sessions parses the query and reads only the first repeated key, so a crafted URI is exempted but treated as a normal session and placed in the general broadcast pool.

Why it is dangerous: An unauthenticated remote attacker can receive the live event stream of a SiYuan kernel even when an access auth code is configured, which can expose note content and activity.

Are you affected?

You are affected if you run SiYuan kernel with an access auth code configured and the kernel port reachable by others, on versions before 0.0.0-20260731131820-67bc300b6ea6.

Package / productAffected versionsFixed in
github.com/siyuan-note/siyuan/kernel · go< 0.0.0-20260731131820-67bc300b6ea60.0.0-20260731131820-67bc300b6ea6

What to do

  1. Update SiYuan kernel to version 0.0.0-20260731131820-67bc300b6ea6 or later
  2. Until updated, do not expose the kernel port to untrusted networks
  3. Restrict access to the kernel port with a firewall or VPN

Timeline

  1. 23 Oct 2026, 18:34 UTC
    Publicly disclosed
  2. 23 Oct 2026, 18:34 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-73054 · GHSA-c8w8-3pqp-wr83
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 18:34 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

SiYuan notes app lets unauthenticated users receive live updates over WebSocket · Zero Radar