SiYuan < 3.7.4 Vulnerability: Critical In-Memory Secret Exposure
- Severity
- CRITICAL
- CVSS
- 9.3
- Affected component
- siyuan (npm)
- Patched version
- 3.7.4
SiYuan versions prior to 3.7.4 are vulnerable to critical exposure of in-memory secrets when the --mode flag is not set to prod. This affects users of the siyuan npm package.
What happened
SiYuan before version 3.7.4 registers Go net/http/pprof debug endpoints without authentication when the --mode flag is not set to exactly prod. This allows attackers to access /debug/pprof/heap and related endpoints to extract sensitive in-memory secrets including AccessAuthCode and AI provider API keys.
The vulnerability has been confirmed by multiple independent sources and assigned CVE-2026-74799 with a CVSS score of 9.3, indicating a critical severity level. The issue was first flagged on August 17, 2026, and confirmed on August 21, 2026.
What to do about it
- Upgrade to SiYuan 3.7.4 or later to mitigate the risk of secret exposure.
- Rotate any secrets in affected environments immediately after upgrading.
- Ensure the --mode flag is set to prod in all production environments to prevent the registration of unauthenticated debug endpoints.
How 0Day would have caught this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using SiYuan versions prior to 3.7.4.
What should I do right now?
Upgrade to SiYuan 3.7.4 or later and rotate any secrets in affected environments.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild according to the primary sources.