SiYuan Software Supply-Chain Vulnerability Under Investigation
SiYuan versions prior to 3.7.2 are under investigation for a critical vulnerability that may allow remote attackers to execute arbitrary code and gain administrator privileges.
What happened
SiYuan before version 3.7.2 appears to contain a missing authorization vulnerability in the POST /mcp kernel endpoint. This issue, tracked as CVE-2026-66012, could allow a remote unauthenticated attacker to read sensitive configuration files, write arbitrary files, and plant a malicious plugin leading to administrator takeover. Additionally, SiYuan desktop before v3.7.2 is under investigation for a reflected cross-site scripting vulnerability in the bazaar plugin readme handler, tracked as CVE-2026-66395. This vulnerability could allow attackers to execute arbitrary code via a crafted siyuan:// deep link.
To assess your exposure, check if you are using SiYuan versions prior to 3.7.2. If so, it is recommended to upgrade to SiYuan v3.7.2 or later to mitigate the reported vulnerabilities. Consult the primary sources for more detailed information on the vulnerabilities and their potential impact.
How 0Day mitigates this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.