{"id":"EUVD-2026-39125","enisaUuid":"fad63caf-f5d8-3692-b323-5c598921ab96","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note\u0027s kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0.","datePublished":"Jun 24, 2026, 9:17:02 PM","dateUpdated":"Jun 25, 2026, 1:55:20 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3\n","aliases":"CVE-2026-54069\nGHSA-hvr9-72v2-fff3\n","assigner":"GitHub_M","epss":7.48,"enisaIdProduct":[{"id":"af3532f5-d971-3805-87bb-e8872f158002","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.0"}],"enisaIdVendor":[{"id":"12fc1072-0b99-31b1-9685-f7c73037787e","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"8a8c717d-e16d-3f73-9f70-370a8f8ec757","vulnerability":{"id":"GHSA-hvr9-72v2-fff3","description":"SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist","datePublished":"Jul 10, 2026, 7:26:06 PM","dateUpdated":"Jul 10, 2026, 7:27:58 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54069\nhttps://github.com/siyuan-note/siyuan\n","enisa_id":"EUVD-2026-39125\n","aliases":"GHSA-hvr9-72v2-fff3\nCVE-2026-54069\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e491384f-9c70-3c49-8db0-b2f378859e51","vulnerability":{"id":"CVE-2026-54069","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note\u0027s kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0.","datePublished":"Jun 24, 2026, 9:17:02 PM","dateUpdated":"Jun 25, 2026, 1:55:20 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3\n","enisa_id":"EUVD-2026-39125\n","assigner":"GitHub_M","epss":7.48,"dataProcessed":"Oct 28, 2026, 7:16:10 AM","vulnerabilityProduct":[{"id":"2c5dd831-2280-3376-86b8-f587cde0924a","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.0"}],"vulnerabilityVendor":[{"id":"88881016-a36e-3ad2-b429-855892ae13ef","vendor":{"name":"siyuan-note"}}]}}],"enisaIdAdvisory":[]}