CVE-2026-74802

high

Description

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.

References

https://www.vulncheck.com/advisories/siyuan-cross-site-websocket-hijacking-via-network-proxy

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cc2-h3v6-rqpq

https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0

https://github.com/siyuan-note/siyuan/commit/cb67e0b4fab57c9c5f458c1fd0df5ecf4417b696

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60085

Details

Source: Mitre, NVD

Published: 2026-08-17

Updated: 2026-08-28

Risk Information

CVSS v2

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:N

Severity: High

CVSS v3

Base Score: 8.2

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Severity: High

CVSS v4

Base Score: 7.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Severity: High

EPSS

EPSS: 0.00164