HIGH 7.5 GitHub
CVE-2026-73054
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
### Summary
Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity.
The result is that an unauthenticated remote caller connects to the kernel WebSocket
Affected Products
- go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260731131820-67bc300b6ea6
References
- https://github.com/advisories/GHSA-c8w8-3pqp-wr83
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8w8-3pqp-wr83
- https://nvd.nist.gov/vuln/detail/CVE-2026-73054
- https://github.com/siyuan-note/siyuan/commit/67bc300b6ea6650d99dae55c827aeced419c8ac4
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-10-23 via GitHub. Affected: go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260731131820-67bc300b6ea6.
vulnfeed aggregates 17167 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.