HIGHCVSS 7.1EPSS 0.2%

CVE-2026-74802

CVE-2026-74802 updated by NVD

Published: 2026-10-02
Modified: 2026-10-02
EPSS percentile: 5%
Sources: github-advisory, nvd

Summary

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/siyuan-note/siyuan/kernel	—	0.0.0-20260803045322-cb67e0b4fab5

Remediation: Upgrade to 0.0.0-20260803045322-cb67e0b4fab5 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-74802

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.