SiYuan Package Under Investigation for Remote Code Execution
- Severity
- HIGH
- Affected component
- siyuan (go)
- Affected versions
- <= 0.0.0-20260313024916-fd6526133bb3
- Patched version
- 3.6.1
An early warning has been issued regarding the SiYuan package before v3.6.1. It appears to fail to sanitize package metadata and README content, potentially allowing remote code execution.
What happened
The SiYuan package before version 3.6.1 is under investigation for a vulnerability that may allow remote code execution. This is due to the package's failure to sanitize package metadata and README content, which could enable malicious actors to inject arbitrary HTML and JavaScript. The affected Go component is siyuan, with versions up to and including 0.0.0-20260313024916-fd6526133bb3. There is no evidence at this time that this vulnerability has been exploited in the wild.
Users of the SiYuan package are advised to assess their exposure by checking the version of the siyuan component in their dependencies. If the version is less than or equal to 0.0.0-20260313024916-fd6526133bb3, it is recommended to upgrade to version 3.6.1 or later as a precautionary measure.
What to do about it
- Identify and list all instances where the SiYuan package is used in your projects.
- Check the version of the siyuan component in your dependencies.
- If the version is less than or equal to 0.0.0-20260313024916-fd6526133bb3, upgrade to version 3.6.1 or later.
- Monitor the primary sources for updates on this vulnerability.
- Consider implementing additional security measures to detect and prevent potential exploitation attempts.
How 0Day would have caught this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using the SiYuan package with a siyuan component version less than or equal to 0.0.0-20260313024916-fd6526133bb3.
What should I do right now?
Check your dependencies for the affected version of the siyuan component and upgrade to version 3.6.1 or later if necessary.
Is there an official fix available?
Yes, version 3.6.1 of the SiYuan package is reported to contain a fix for this vulnerability.
Should I be concerned about exploitation in the wild?
There is no confirmed evidence of this vulnerability being exploited in the wild at this time, but it is advisable to take precautionary measures.