SiYuan Go Package Vulnerability: Database Schema Disclosure
- Severity
- HIGH
- Affected component
- siyuan (go)
- Affected versions
- <= 0.0.0-20260313024916-fd6526133bb3
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the SiYuan Go package. The getAttributeViewKeysByID endpoint reportedly discloses the full column schema of a database without proper filtering. Additionally, two other endpoints return workspace-wide block IDs without proper scoping.
What happened
The SiYuan Go package, specifically versions <= 0.0.0-20260313024916-fd6526133bb3, is under investigation for a critical vulnerability. The getAttributeViewKeysByID endpoint appears to disclose the full column schema of a database due to a missing publish-access filter. This could potentially expose sensitive database information to unauthorized users. Furthermore, two other endpoints are reported to return workspace-wide block IDs without proper scoping, which may lead to further unauthorized access or data leakage.
This vulnerability has been tracked under CVE-2026-72800 and GHSA-5FHR-F75J-8WR9. It is important for users of the SiYuan Go package to assess their exposure and take appropriate action to mitigate potential risks.
What to do about it
- Review your use of the SiYuan Go package and identify if you are using a version <= 0.0.0-20260313024916-fd6526133bb3.
- Monitor for patches and updates from the SiYuan maintainers to address the disclosed vulnerabilities.
- Consider implementing additional access controls and filtering mechanisms as a temporary measure until an official patch is released.
- No official fix has been published yet. Monitor the sources below for updates on patches or mitigations.
How 0Day would have caught this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using the SiYuan Go package version <= 0.0.0-20260313024916-fd6526133bb3.
What should I do right now?
Review your use of the SiYuan Go package, monitor for updates from the maintainers, and consider implementing additional access controls until a patch is available.
Is there an official patch available?
No official patch has been published yet. Continue to monitor the sources for updates.