SiYuan MCP Tool Vulnerabilities in Versions ≤3.8.0

Two security vulnerabilities discovered in SiYuan's AI Agent MCP tools: asset.upload allows reading arbitrary absolute file paths outside workspace boundaries via prompt injection, and http_request/web_fetch tools are vulnerable to DNS-rebinding SSRF attacks that bypass CheckHostSSRF validation.

Disclosed 13 August 2026 · Record updated 2 October 2026

Impact

Attackers can exploit prompt injection to extract sensitive files (SSH keys, AWS credentials, /etc/passwd) or access internal services and cloud metadata via SSRF, potentially compromising user data and internal infrastructure.

Our coverage

A vault door stands ajar while invisible hands rifle through filing cabinets; a puppet's strings lead toward shadowy corridors inside fortress walls.

Vulnerabilities

SiYuan patches two AI agent tool flaws in note-taking app

Advisories published on 2 October 2026 say SiYuan's MCP tools could read any local file and be tricked into reaching internal network addresses.

2 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-p23f-cm6q-2qp8
github.comhttps://github.com/advisories/GHSA-x8gv-g2g3-65fj