CVE-2026-59809— SiYuan before v3.8.0 Secret Exfiltration via http_request URL
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| siyuan-note | siyuan | < 3.8.0 | affected |
3.8.0 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59809
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before v3.8.0 Secret Exfiltration via http_request URL
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values to any public host without confirmation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.8.0 | - |
II. Public POCs for CVE-2026-59809
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59809
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-59809 (2)
Same Patch Batch · siyuan-note · 2026-08-22 · 4 CVEs total
| CVE-2026-60084 | 8.7 HIGH | SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate |
| CVE-2026-62204 | 6.6 MEDIUM | SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install |
| CVE-2026-60083 | 4.9 MEDIUM | SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool |
IV. Related Vulnerabilities
Same product: siyuan
- CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install - CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTempl - CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file - CVE-2026-77086
SiYuan before v3.7.4 Path Traversal via packageName - CVE-2026-75917
SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
Same vendor: siyuan-note
- CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install - CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTempl - CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file - CVE-2026-77086
SiYuan before v3.7.4 Path Traversal via packageName - CVE-2026-75917
SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
Same weakness: CWE-201
- CVE-2026-63481
Hurl: Cookies in Cookies section leak when redirecting to a - CVE-2026-75953
Joomla Extension - cmsjunkie.com - Open mail relay in J-Bus - CVE-2026-73386
WordPress Track Geolocation Of Users Using Contact Form 7 pl - CVE-2026-73384
WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitiv - CVE-2026-74008
WordPress Shortcodes and extra features for Phlox theme plug
V. Comments for CVE-2026-59809
No comments yet