Th...
id: GO-ID-PENDING
modules:
- module: github.com/siyuan-note/siyuan/kernel
versions:
- fixed: 0.0.0-20260725125659-1ca1c3c9d94b
summary: |-
SiYuan: Embedded (transclusion) block content is returned without publish-access
filtering, leaking private and password-protected document content to anonymous
readers in github.com/siyuan-note/siyuan/kernel
cves:
- CVE-2026-72795
ghsas:
- GHSA-h6w7-xxcf-w2mq
references:
- advisory: https://github.com/advisories/GHSA-h6w7-xxcf-w2mq
- advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h6w7-xxcf-w2mq
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-72795
- fix: https://github.com/siyuan-note/siyuan/commit/1ca1c3c9d94bea14fc9728ff2fb8392bb0f29732
- web: https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-embed-block
notes:
- fix: 'github.com/siyuan-note/siyuan/kernel: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
id: GHSA-h6w7-xxcf-w2mq
created: 2026-09-04T22:01:55.34691693Z
review_status: UNREVIEWED
Advisory GHSA-h6w7-xxcf-w2mq references a vulnerability in the following Go modules:
Description:
CVE: This vulnerability corresponds to CVE-2026-72795.
Summary
/api/block/getBlockDOMWithEmbedand/api/block/getBlockDOMsWithEmbedgate only the requested block against publish access. The blocks pulled in by that block's embed (transclusion) query are inlined into the returned DOM with no publish-access check at all, so a reader who requests a legitimately-published block containing an embed query receives the content of every block that query matched including blocks in hidden, forbidden and password-protected documents.Th...
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.