CVE-2026-59809— SiYuan before v3.8.0 Secret Exfiltration via http_request URL
Quick assessment
Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 SiYuan v3.8.0 版本之前，存在一个漏洞，该漏洞允许攻击者从目标应用程序中窃取存储的机密数据。具体来说，http_request MCP 工具会将机密占位符直接插入到目标 URL 参数中，从而导致机密信息泄露。攻击者可以构造一个包含由他们控制的 URL 的 MCP 客户端请求，该 URL 中包含机密占位符，从而将明文状态的机密值发送到任何公共主机，且此过程无需确认。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| siyuan-note | siyuan | < 3.8.0 |
affected |
3.8.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59809
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before v3.8.0 Secret Exfiltration via http_request URL
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values to any public host without confirmation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.8.0 | - |
|
II. Public POCs for CVE-2026-59809
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59809
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-59809 (2)
Same Patch Batch · siyuan-note · 2026-08-22 · 4 CVEs total
| CVE-2026-60084 | 8.7 HIGH | SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate |
| CVE-2026-62204 | 6.6 MEDIUM | SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install |
| CVE-2026-60083 | 4.9 MEDIUM | SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool |
IV. Related Vulnerabilities
Same product: siyuan
-
CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install -
CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTempl -
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-77086
SiYuan before v3.7.4 Path Traversal via packageName -
CVE-2026-75917
SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
Same vendor: siyuan-note
-
CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install -
CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTempl -
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-77086
SiYuan before v3.7.4 Path Traversal via packageName -
CVE-2026-75917
SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
Same weakness: CWE-201
-
CVE-2026-63481
Hurl: Cookies in Cookies section leak when redirecting to a -
CVE-2026-75953
Joomla Extension - cmsjunkie.com - Open mail relay in J-Bus -
CVE-2026-73386
WordPress Track Geolocation Of Users Using Contact Form 7 pl -
CVE-2026-73384
WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitiv -
CVE-2026-74008
WordPress Shortcodes and extra features for Phlox theme plug
V. Comments for CVE-2026-59809
No comments yet