{"cve":"CVE-2026-74802","nvd":{"published":"2026-08-17T11:16:40.453","modified":"2026-08-28T16:18:24.673","status":"Deferred","description":"SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","score":8.2},"cwes":["CWE-346"],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cc2-h3v6-rqpq","https://www.vulncheck.com/advisories/siyuan-cross-site-websocket-hijacking-via-network-proxy","https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cc2-h3v6-rqpq"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-74802","score":0.00164,"percentile":0.05561,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-3cc2-h3v6-rqpq","url":"https://osv.dev/vulnerability/GHSA-3cc2-h3v6-rqpq","summary":"SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass","modified":"2026-10-07T17:55:42.822624930Z","packages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel","ranges":["<0.0.0-20260803045322-cb67e0b4fab5"],"fixed":["0.0.0-20260803045322-cb67e0b4fab5"]}]},{"id":"GO-2026-6650","url":"https://osv.dev/vulnerability/GO-2026-6650","summary":"SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernel","modified":"2026-10-07T17:45:13.483118596Z","packages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel","ranges":["<0.0.0-20260803045322-cb67e0b4fab5"],"fixed":["0.0.0-20260803045322-cb67e0b4fab5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}