SiYuan before v3.8.0 Secret Exfiltration via http_request URL

Advisories

SiYuan before v3.8.0 Secret Exfiltration via http_request URL

severity: medium
date: 8/22/2026
Affecting: siyuan >= 0, < 3.8.0
CVE: CVE-2026-59809
CWE: CWE-201 Insertion of Sensitive Information Into Sent Data
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: GitHub Security Advisory (GHSA-853m-gvvm-6rvx)
Credit: alham-rizvi
Description: SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values to any public host without confirmation.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo