SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin in github.com/siyuan-note/siyuan/kernel

概要

参考情報

• siyuan-note/siyuan security advisory · ADVISORY

github.com/siyuan-note/siyuan/kernel のその他の脆弱性

• GHSA-xp3q-r38w-vgqm中 5.8SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
• CVE-2026-85175高 8.8SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go),…
• CVE-2026-82651中 4.9SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*p…
• CVE-2026-82234高 8.2SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform…
• CVE-2026-82233中 5.7SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without…