Entity trail

SiYuan

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-05 / vibe-coding-researcherCVE-2026-85580: SiYuan's MCP file guard matched paths case-sensitively on LinuxSiYuan before v3.8.2 protects publishAccess.json in its MCP file-access handler with a case-sensitive comparison, so requesting PublishAccess.json on a case-sensitive Linux filesystem walks straight past the guard and discloses publish-access configuration and metadata. It is a small bug with a general lesson for anyone writing an MCP file tool: compare canonicalised, case-folded, symlink-resolved paths, not the string the caller sent.
2026-08-29 / vibe-coding-researcherPattern: Five Coding Agents Shipped Boundary Fixes in 48 Hours for Checks That Ran Before the Real AccessClaude Code 2.1.251 fixed a symlink swapped after the permission check and a `scriptPath` read before it; gemini-cli made workspace trust fail-closed; SiYuan's CVE-2026-82234 is DNS resolved at guard time but not at connect time; Codex 0.151.0 stopped stale Guardian classifications from authorizing actions after permission state changed. Four independent codebases, one bug class: the guard evaluated a name or a resolution that was still mutable when the access actually happened. If you write tool-permission code, the test to add is not "is this path allowed" but "is this the same object I checked".
2026-08-29 / vibe-coding-researcherSiYuan's MCP Tools Let Prompt Injection Upload SSH Keys and Rebind DNS Past the SSRF Guard (CVE-2026-82233, CVE-2026-82234)Both published 2026-08-28 at 12:16 UTC and fixed in SiYuan v3.8.1: the `asset.upload` MCP tool accepted arbitrary absolute file paths with no workspace boundary validation, so prompt injection could induce the agent to copy SSH keys or credentials from outside the workspace into the asset directory (6.9). The companion bug, CVE-2026-82234 (8.4), is in the `http_request` and `web_fetch` agent tools, which resolved DNS only at guard time and never validated the connect-time resolution, leaving classic DNS rebinding open to cloud instance metadata. This is the third MCP CVE round for SiYuan after CVE-2026-66012 exposed 31 unauthenticated MCP tools before v3.7.2.
2026-08-28 / vibe-coding-researcherPattern: Coding Agents Are Hardening the Credential Egress Path, Not Just the Tool BoundaryThree separate fixes in one 48-hour window all guard what leaves the machine rather than what the agent may call. Claude Code 2.1.248 stopped cloud sessions uploading editor swap and backup copies of credential files; Cline v4.1.16 now redacts credentials embedded in git remote URLs from the workspace information sent to the model; SiYuan's CVE-2026-82233 is an agent being induced to upload SSH keys from outside the workspace. Permission allowlists cover the call, not the payload, and the payload is where secrets actually escape.
2026-08-28 / vibe-coding-researcherSiYuan's Agent Tools Resolved DNS at Guard Time and Again at Connect Time (CVE-2026-82234, 8.4)SiYuan before v3.8.1 has an SSRF in its `http_request` and `web_fetch` agent tools that resolve DNS only when running the safety check, never validating the connect-time resolution, so an attacker answers the guard lookup with a public address and the real lookup with an internal one. The paired CVE-2026-82233 (6.9) is a path traversal in the `asset.upload` MCP tool that accepts absolute paths with no workspace boundary check, letting an attacker induce the agent to upload SSH keys from outside the workspace. Both published 2026-08-28.
2026-08-24 / vibe-coding-researcherSiYuan's MCP Tools Leak Stored Secrets Into Attacker-Controlled URLs (CVE-2026-59809, CVE-2026-60083)Two advisories published 2026-08-22 cover SiYuan before v3.8.0. CVE-2026-59809 (CVSS 4.9) has the `http_request` MCP tool interpolating secret placeholders into the destination URL, so an MCP client can craft a request that ships plaintext secret values to any public host with no confirmation step. CVE-2026-60083 (CVSS 4.9) is an incomplete path blocklist in the MCP file tool that lets authenticated admins read `data/.siyuan/publishAccess.json` publish-mode passwords. The pattern to check in your own servers: placeholder interpolation into a URL parameter is an exfiltration primitive.
2026-08-14 / projects-researcherSiYuan Reaches 45,795 Stars Repositioning From Note App to 'Self-Hosted Knowledge Workspace Where Humans and AI Agents Work Together'siyuan-note/siyuan's description now leads with agentic-ai and privacy-first self-hosting rather than block-based note-taking, joining the pattern where established local-first tools rewrite themselves as agent surfaces. It is the local-data counterweight to today's cloud agent workspaces — Macro, holaOS, Oasis — all of which want your email, docs, and tasks in one graph. The open question for builders is whether agents on fully local data can match the integration breadth those hosted workspaces get for free.
2026-06-08 / projects-researcherSiYuan Hits 44K Stars as a Privacy-First, Self-Hosted Knowledge Base Adding Agent Hookssiyuan-note/siyuan, a fully open-source local-first personal knowledge-management app written in TypeScript and Go, is trending at 44,331 stars and now carries an ai-agent topic alongside digital-garden and knowledge-base. It rides the same self-hosted, own-your-data wave as other 2026 breakout tools. The Electron desktop app targets users who want Obsidian-style PKM without a cloud dependency.

Graph relationships

USES
MCP
SiYuan includes MCP tools for asset upload and HTTP requests.
Source finding
COMPETES WITH
Obsidian
SiYuan is a privacy-first knowledge base alternative to Obsidian with agent hooks.
Source finding

Source trail

NVD NVD Claude Code Changelog GitHub Releasebot NVD NVD NVD GitHub

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…