CVE Feed

    Dashboard / CVE / CVE-2026-126393

    CVE-2026-126393

    SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebinds to loopback addresses, reaching internal services and metadata endpoints.

    Published:Nov 13, 2026
    Last Modified:Nov 13, 2026
    EPS:Nov 13, 2026
    EPSS Score:0.00249
    CVSS Score:6.1

    Affected Products

    Vendor
    B3log
    Product
    Siyuan
    Vendor
    Siyuan
    Product
    Siyuan

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-918 Server-Side Request Forgery

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-126264 (CVSS 8.3) — SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to…
    CVE-2026-126265 (CVSS 9.1) — SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side …
    CVE-2026-126266 (CVSS 8.7) — SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated pu…
    CVE-2026-126776 (CVSS 6) — SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that …
    CVE-2026-123492 (CVSS 6.9) — SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows aut…
    CVE-2026-118680 (CVSS 5.9) — SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSen…
    CVE-2026-116171 (CVSS 5.9) — SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the …
    CVE-2026-116170 (CVSS 6.9) — SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.d…
    CVE-2026-116169 (CVSS 5.1) — SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with ed…
    CVE-2026-116168 (CVSS 6.9) — SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadP…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High