SiYuan Package Vulnerability: Session-Cookie Signing Key Exposure
- Severity
- HIGH
- Affected component
- siyuan (go)
- Affected versions
- <= 0.0.0-20260313024916-fd6526133bb3
- Patched version
- Not yet available
An early warning has been issued regarding a vulnerability in the SiYuan package. The session-cookie signing key (Conf.CookieKey) is reportedly exposed to anonymous readers via the /api/system/getConf endpoint.
What happened
The SiYuan package, specifically versions up to and including 0.0.0-20260313024916-fd6526133bb3, appears to expose the session-cookie signing key (Conf.CookieKey) to unauthorized users. This key is critical as it is used to sign the server's session cookies. The exposure occurs through the /api/system/getConf endpoint, which returns the key to any reader, regardless of their authorization status.
Additionally, there are reports of other vulnerabilities in the SiYuan package. These include the exposure of database view structures to anonymous readers via the /api/av/getAttributeViewFieldViews endpoint and the disclosure of the private document tree to anonymous readers due to a missing publish-access filter on the HPath/path-resolution endpoints.
What to do about it
- Review your use of the SiYuan package to determine if you are using a vulnerable version.
- If you are using a vulnerable version, immediately update the SiYuan package to a version that is not affected by these vulnerabilities.
- Ensure that the session-cookie signing key is not exposed to unauthorized users in your configuration.
- Monitor the primary sources for updates on patched versions and additional mitigation steps.
- Consider implementing additional access controls to restrict the exposure of sensitive configuration data.
How 0Day would have caught this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using the SiYuan package version 0.0.0-20260313024916-fd6526133bb3 or earlier.
What should I do right now?
Review and update your SiYuan package to ensure the session-cookie signing key is not exposed to unauthorized users. Monitor the primary sources for updates on patched versions and additional mitigation steps.
Has this been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.
Are there any official fixes available?
No official fix has been published yet. Monitor the primary sources for updates on patched versions.
Sources
- [GHSA-34fj-mwm6-fjfg] SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
- [GHSA-57v5-wqx3-cgj4] SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews
- [GHSA-5w7r-f4cg-rqq7] SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers