How many CVEs have a located fix in siyuan-note/siyuan?

67 published CVEs have a fix traced to functions in siyuan-note/siyuan, touching 239 functions across 91 files.

Which function in siyuan-note/siyuan has been patched by the most CVEs?

IsSensitivePath in kernel/util/path.go has been changed by 8 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in siyuan-note/siyuan?

The median fix changes 34 lines. 40% of fixes change 20 lines or fewer, and 24% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

go

typescript

#58 of 500 repositories

siyuan-note/siyuan

Name: siyuan-note/siyuan: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 12, 2026

67

CVE fixes located

Published CVEs

239

Functions patched

Distinct function sites

91

Files patched

Distinct source files

2025–2026

Years covered

By CVE publication date

Overview

67 published CVEs have a fix traced to functions in siyuan-note/siyuan, the earliest published in 2025. Those fixes changed 239 distinct functions across 91 files, in 711 patch hunks.

Among the 500 repositories tracked here, siyuan-note/siyuan ranks #58 by the number of CVEs with a located fix.

Most patched functions

Functions in siyuan-note/siyuan changed by the most CVE fixes.

Most patched files

Files in siyuan-note/siyuan changed by the most CVE fixes.

1kernel/model/publish_access.go11 CVEs · 18 functions
2kernel/server/serve.go9 CVEs · 9 functions
3kernel/util/path.go8 CVEs · 3 functions
4kernel/api/block.go7 CVEs · 31 functions
5kernel/api/search.go6 CVEs · 6 functions
6kernel/api/router.go6 CVEs · 1 functions
7kernel/model/block.go4 CVEs · 8 functions
8kernel/api/file.go4 CVEs · 4 functions
9kernel/util/misc.go4 CVEs · 4 functions
10kernel/api/ref.go3 CVEs · 6 functions

Fix size

How much code a CVE fix in siyuan-note/siyuan changes, with backports counted once.

34

Median lines changed

Added plus removed, per CVE

40%

Fixes of 20 lines or fewer

Share of CVE fixes

24%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in siyuan-note/siyuan, and the functions each fix changed.

SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
CVE-2026-109309pluginServiceFileAbsPath pluginServiceHTTPResponse PreparePrivateService
Medium · CVSS 6.9
EPSS 0.4%2026-10-12
SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
CVE-2026-101092GetCurrentAttributeViewImages IsReadOnlyRole
Medium · CVSS 6.9
EPSS 0.2%2026-09-28
SiYuan before v3.8.4 SQL Injection via Block Query Embed
CVE-2026-101091checkRawBlockQueryStmt CheckReadonlyBlockQueryStatement selectBlocksRawStmtWithQuery
High · CVSS 7.1
EPSS 0.3%2026-09-28
SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
CVE-2026-100641RiffCard afterCB IRiffCard
High · CVSS 8.6
EPSS 0.5%2026-09-26
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
CVE-2026-100635RoundTrip GetBasicAuthUsernameBySessionID AddSession
High · CVSS 8.2
EPSS 0.3%2026-09-26
SiYuan before 3.8.4 Cross-Site Scripting via Document Title
CVE-2026-92986SearchPath Path outline
High · CVSS 8.6
EPSS 0.8%2026-09-17
SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
CVE-2026-92985SearchPath Path outline
High · CVSS 8.6
EPSS 0.8%2026-09-17
SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
CVE-2026-87808fullTextSearchBlock
High · CVSS 8.7
EPSS 0.4%2026-09-09
SiYuan before 3.8.2 Remote Code Execution via Clipboard
CVE-2026-86712streamInsert
High · CVSS 8.6
EPSS 0.7%2026-09-08
SiYuan before v3.7.4 Missing Authorization via block API
CVE-2026-74904checkBlockRef checkBlockFold getTreeStat
High · CVSS 8.7
EPSS 0.5%2026-08-18
SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy
CVE-2026-74802HandleRpcWebSocket handleWebSocketRequest wsProxy
High · CVSS 7.1
EPSS 0.2%2026-08-17
SiYuan before v3.7.4 Missing Authorization via refreshBacklink
CVE-2026-72812QueryRefsByDefID QueryRefsByDefIDInBox refreshBacklink
Medium · CVSS 6.9
EPSS 0.4%2026-08-14

Get an alert for each new siyuan-note/siyuan CVE, with the patched functions and AI-written analysis.

Monitor siyuan CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

glpi-project/glpi67 CVEs python-pillow/Pillow66 CVEs mintplex-labs/anything-llm69 CVEs OISF/suricata65 CVEs go.googlesource.com/go64 CVEs ImageMagick/ImageMagick671 CVEs open-webui/open-webui71 CVEs FasterXML/jackson-databind72 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in siyuan-note/siyuan.

How many CVEs have a located fix in siyuan-note/siyuan?: 67 published CVEs have a fix traced to functions in siyuan-note/siyuan, touching 239 functions across 91 files.
Which function in siyuan-note/siyuan has been patched by the most CVEs?: IsSensitivePath in kernel/util/path.go has been changed by 8 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in siyuan-note/siyuan?: The median fix changes 34 lines. 40% of fixes change 20 lines or fewer, and 24% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track siyuan-note/siyuan CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing