NIXPKGS-2026-2682

GitHub issue published 15 minutes ago

Out of bounds write in PDP ctx GSN-Address decode

Permalink CVE-2026-75892

updated 15 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub 15 minutes ago

Out of bounds write in PDP ctx GSN-Address decode

• https://cgit.osmocom.org/osmo-ggsn/commit/?id=6c322f4dd339401a437da3c89c95f2bf6… patchmitigation

---

osmo-ggsn

• ==1.14.0

NIXPKGS-2026-2681

GitHub issue published 15 minutes ago

Mealie before 3.21.0 Information Disclosure via Ratings Endpoint

Permalink CVE-2026-93736

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @Scrumplex ignored
  2 packages

  • python313Packages.aiomealie
  • python314Packages.aiomealie
  an hour ago
• @Scrumplex accepted an hour ago
• @LeSuisse published on GitHub 15 minutes ago

Mealie before 3.21.0 Information Disclosure via Ratings Endpoint

• GitHub Issue #7909 exploitissue-tracking
• https://github.com/mealie-recipes/mealie product
• https://github.com/mealie-recipes/mealie/blob/v3.20.1/mealie/routes/users/ratin… technical-description
• https://github.com/mealie-recipes/mealie/blob/v3.20.1/mealie/repos/repository_u… technical-description
• https://github.com/mealie-recipes/mealie/pull/7903 patchissue-tracking
• https://github.com/mealie-recipes/mealie/commit/6889101a760a457019276c10514e630… patch
• mealie v3.21.0 Release Notes release-notes
• VulnCheck Advisory: Mealie before 3.21.0 Information Disclosure via Ratings Endpoint third-party-advisory

---

mealie

• <3.21.0

NIXPKGS-2026-2680

GitHub issue published 15 minutes ago

PPPD buffer overflow in PEAP response code

Permalink CVE-2026-75883

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 15 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @Scrumplex ignored
  9 packages

  • luppp
  • rpPPPoE
  • rp-pppoe
  • perlPackages.DevelPPPort
  • python313Packages.xmpppy
  • python314Packages.xmpppy
  • perl5Packages.DevelPPPort
  • perlPackages.ModuleBuildPluggablePPPort
  • perl5Packages.ModuleBuildPluggablePPPort
  an hour ago
• @Scrumplex accepted an hour ago
• @LeSuisse published on GitHub 15 minutes ago

PPPD buffer overflow in PEAP response code

• https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35 vendor-advisory

---

ppp

• ==2.5.4
• =<2.5.0

NIXPKGS-2026-2679

GitHub issue published 16 minutes ago

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Permalink CVE-2026-75157

updated 16 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 59 minutes ago
• @LeSuisse published on GitHub 16 minutes ago

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

• https://github.com/apache/airflow/pull/71736 patch
• https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/09/18/1

---

apache-airflow

• <3.3.2

NIXPKGS-2026-2678

GitHub issue published 16 minutes ago

Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

Permalink CVE-2026-32641

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 16 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 56 minutes ago
• @LeSuisse published on GitHub 16 minutes ago

Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

• https://github.com/parseablehq/parseable/security/advisories/GHSA-x4q9-j9qh-3rpx x_refsource_CONFIRM
• https://github.com/parseablehq/parseable/pull/1581 x_refsource_MISC
• https://github.com/parseablehq/parseable/commit/6c583081a4161476128f330b9bb71ed7305eecde x_refsource_MISC
• https://github.com/parseablehq/parseable/releases/tag/v3.0.0 x_refsource_MISC

---

parseable

• ==< 3.0.0

NIXPKGS-2026-2677

GitHub issue published 17 minutes ago

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Permalink CVE-2026-58197

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 17 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 43 minutes ago
• @LeSuisse published on GitHub 17 minutes ago

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

• https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8 x_refsource_CONFIRMexploit
• https://github.com/stacklok/toolhive-studio/pull/2469 x_refsource_MISC
• https://github.com/stacklok/toolhive/pull/5583 x_refsource_MISC
• https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0 x_refsource_MISC
• https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712 x_refsource_MISC
• https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0 x_refsource_MISC
• https://github.com/stacklok/toolhive/releases/tag/v0.30.1 x_refsource_MISC

---

toolhive

• ==< 0.30.1

toolhive-studio

• ==< 0.38.0

Needs a backport

NIXPKGS-2026-2676

GitHub issue published 18 minutes ago

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

Permalink CVE-2026-93676

3.2 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 18 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 37 minutes ago
• @LeSuisse published on GitHub 18 minutes ago

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

• https://access.redhat.com/security/cve/CVE-2026-93676 x_refsource_REDHATvdb-entry
• RHBZ#2537014 x_refsource_REDHATissue-tracking

---

xdg-dbus-proxy

https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c

NIXPKGS-2026-2675

GitHub issue published 18 minutes ago

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Permalink CVE-2026-77339

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 18 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 32 minutes ago
• @LeSuisse published on GitHub 18 minutes ago

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

• https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v x_refsource_CONFIRMexploit
• https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858 x_refsource_MISC
• https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0 x_refsource_MISC

---

process-compose

• ==< 1.120.0

NIXPKGS-2026-2674

GitHub issue published 19 minutes ago

Reachable assertion at ranap_handle_co_dt()

Permalink CVE-2026-75894

updated 19 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 30 minutes ago
• @LeSuisse published on GitHub 19 minutes ago

Reachable assertion at ranap_handle_co_dt()

• https://cgit.osmocom.org/osmo-iuh/commit/?id=f06967126f486bcb185ccf3d1a8f9bc02c… patchmitigation

---

osmo-iuh

• <1.8.0

NIXPKGS-2026-2673

GitHub issue published 23 minutes ago

siyuan: security issues < 3.8.5

Permalink CVE-2026-93921

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 23 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 24 minutes ago
• @LeSuisse published on GitHub 23 minutes ago

SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint

• GitHub Security Advisory (GHSA-whcx-xxqh-c838) vendor-advisory
• https://github.com/siyuan-note/siyuan product
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/api/router.go#L51 technical-description
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/template.go#L485… technical-description
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/api/icon.go#L546-L549 technical-description
• VulnCheck Advisory: SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint third-party-advisory

---

github.com/siyuan-note/siyuan/kernel

• =<3.8.4

Permalink CVE-2026-93923

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 23 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 25 minutes ago
• @LeSuisse published on GitHub 23 minutes ago

SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

• GitHub Security Advisory (GHSA-928g-4hfq-qwvx) vendor-advisory
• https://github.com/siyuan-note/siyuan product
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/render.go#L71-L76 technical-description
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/Tree.ts#L133 technical-description
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/Tree.ts#L194 technical-description
• VulnCheck Advisory: SiYuan through 3.8.4 Stored XSS via Heading Style Attribute third-party-advisory

---

github.com/siyuan-note/siyuan/kernel

• =<3.8.4

Permalink CVE-2026-93591

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 23 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted 40 minutes ago
• @LeSuisse published on GitHub 23 minutes ago

SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go

• GitHub Security Advisory (GHSA-5rwv-4j4c-f954) exploitvendor-advisory
• VulnCheck Advisory: SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go third-party-advisory

---

siyuan

• <3.8.3
• ==3.8.3

Permalink CVE-2026-93922

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 23 minutes ago by @LeSuisse Activity log

• Created suggestion 8 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub 23 minutes ago

SiYuan through 3.8.4 Stored XSS via notebook names

• GitHub Security Advisory (GHSA-8c2m-33v9-vvqm) vendor-advisory
• https://github.com/siyuan-note/siyuan product
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/mount.ts#L72 technical-description
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/file.go#L2446-L2… technical-description
• VulnCheck Advisory: SiYuan through 3.8.4 Stored XSS via notebook names third-party-advisory

---

github.com/siyuan-note/siyuan/kernel

• =<3.8.4