{"id":"EUVD-2026-67686","enisaUuid":"9190622e-b890-3113-9baa-2c50f7d54100","description":"SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services.","datePublished":"Aug 28, 2026, 10:49:24 AM","dateUpdated":"Aug 28, 2026, 4:10:07 PM","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x8gv-g2g3-65fj\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.1-ssrf-via-dns-rebinding-toctou\n","aliases":"CVE-2026-82234\nGHSA-g42r-m263-958h\n","assigner":"VulnCheck","epss":0.36,"enisaIdProduct":[{"id":"43e6b7d4-479f-3dff-b561-152548437083","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.8.1"}],"enisaIdVendor":[{"id":"5c18d383-e4b0-3f74-858b-2a369510f111","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"731a9c33-844f-359d-9a13-22b688cf7165","vulnerability":{"id":"CVE-2026-82234","description":"SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services.","datePublished":"Aug 28, 2026, 10:49:24 AM","dateUpdated":"Aug 28, 2026, 4:10:07 PM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x8gv-g2g3-65fj\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.1-ssrf-via-dns-rebinding-toctou\n","enisa_id":"EUVD-2026-67686\n","assigner":"VulnCheck","epss":0.36,"dataProcessed":"Nov 9, 2026, 3:06:41 PM","vulnerabilityProduct":[{"id":"14be92e4-0015-349a-b36a-9436dcaf0d35","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.8.1"}],"vulnerabilityVendor":[{"id":"718aaab1-ac03-308a-89ce-3ee06dd97515","vendor":{"name":"siyuan-note"}}]}},{"id":"8524c86e-559b-3528-8b73-937b996848e4","vulnerability":{"id":"GHSA-g42r-m263-958h","description":"SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services.","datePublished":"Aug 28, 2026, 12:30:26 PM","dateUpdated":"Aug 28, 2026, 12:30:26 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x8gv-g2g3-65fj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82234\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.1-ssrf-via-dns-rebinding-toctou\n","enisa_id":"EUVD-2026-67686\n","aliases":"GHSA-g42r-m263-958h\nCVE-2026-82234\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:52:25 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}