siyuan
siyuan 3.8.2 · pkgs/by-name/si/siyuan/package.nix
Health
Risk
risk 76 critical
- +60 8 open advisories
- +8 NIXPKGS-2026-2995 has a public exploit (CISA)
- +8 3.8.2 is behind upstream 3.8.7
Version
3.8.2 upstream 3.8.7
Channels
Hydra
succeeded 1d ago
Advisories
NIXPKGS-2026-2775 high 8.5 public exploit EPSS 0.5% siyuan: security issues < 3.8.4 · #567651
CVE-2026-100633, CVE-2026-100634, CVE-2026-100635, CVE-2026-100636, CVE-2026-100637, CVE-2026-100638, CVE-2026-100639, CVE-2026-100640, CVE-2026-100641, CVE-2026-100642, CVE-2026-100643, CVE-2026-100644, CVE-2026-100645, CVE-2026-100646
NIXPKGS-2026-2895 high 8.7 public exploit EPSS 0.4% siyuan: security issues < 3.8.5 · #569840
CVE-2026-103762, CVE-2026-103763, CVE-2026-104410
NIXPKGS-2026-2995 high 7.1 public exploit EPSS 0.4% siyuan: security issues < 3.8.6 · #573663
CVE-2026-109309, CVE-2026-109310
NIXPKGS-2026-2805 high 7.1 public exploit EPSS 0.3% SiYuan before v3.8.4 SQL Injection via Block Query Embed · #568136
CVE-2026-101091
NIXPKGS-2026-2809 medium 6.9 public exploit EPSS 0.2% SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages · #568140
CVE-2026-101092
NIXPKGS-2026-2899 medium 6.9 public exploit EPSS 0.2% SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo · #570422
CVE-2026-105205
NIXPKGS-2026-2673 EPSS 0.8% siyuan: security issues < 3.8.5 · #564878
CVE-2026-93591, CVE-2026-93921, CVE-2026-93922, CVE-2026-93923
NIXPKGS-2026-2532 SiYuan before v3.8.2 Private Attribute View Key Enumeration fixed in master needs backport to nixos-26.05
NIXPKGS-2026-2486 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist fixed in master needs backport to nixos-26.05
Packaging
not read yet: the next index sweep reads it
Pull requests 1
treewide: don't install .pak files for wrapped Electron apps
#542955 by TomaSajt · opened 3mo ago · checks pass
Closed or merged in the synced window 5
siyuan: 3.7.3 -> 3.8.2
#556604 by mtul0729 · merged 5w ago
siyuan: 3.7.3 -> 3.8.0
#552595 by mtul0729 · closed 7w ago
siyuan: 3.7.1 -> 3.7.3
#545806 by mtul0729 · closed 2mo ago
[Backport release-25.11] siyuan: 3.6.2 -> 3.6.3
#511224 by nixpkgs-ci · closed 5mo ago
Issues 5
siyuan: security issues < 3.8.6 1.severity: security
#573663 by nixpkgs-security-tracker · opened 3d ago · 0 comments
siyuan: security issues < 3.8.5 1.severity: security
#569840 by nixpkgs-security-tracker · opened 13d ago · 0 comments
siyuan: security issues < 3.8.4 1.severity: security
#567651 by nixpkgs-security-tracker · opened 2w ago · 0 comments
siyuan: security issues < 3.8.5 1.severity: security
#564878 by nixpkgs-security-tracker · opened 3w ago · 0 comments
siyuan: security issues < 3.8.4 1.severity: security
#564491 by nixpkgs-security-tracker · opened 4w ago · 0 comments
Closed or merged in the synced window 6
siyuan: security issues < 3.7.4 1.severity: security
#558335 by nixpkgs-security-tracker · closed 5w ago · 0 comments
siyuan: security issues < 3.8.1 1.severity: security
#558331 by nixpkgs-security-tracker · closed 5w ago · 0 comments
siyuan: security issues < 3.7.4 1.severity: security
#553008 by nixpkgs-security-tracker · closed 5w ago · 0 comments
siyuan: security issues < 3.7.4 1.severity: security
#552150 by nixpkgs-security-tracker · closed 5w ago · 0 comments
SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS 1.severity: security
#520513 by nixpkgs-security-tracker · closed 6w ago · 0 comments
SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs 1.severity: security
#520495 by nixpkgs-security-tracker · closed 6w ago · 0 comments