CVE-2026-73610 SiYuan before v3.7.4 Information Disclosure via Local Storage
Unauthenticated attackers can retrieve sensitive local storage data, including history and private identifiers, from SiYuan note-taking application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73610?
CVE-2026-73610 is a medium-severity vulnerability in siyuan-note siyuan, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.
Weakness: CWE-639
Which versions are affected by CVE-2026-73610?
How do I fix CVE-2026-73610?
No fix has been published for CVE-2026-73610 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73610 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73610 exists.
Sources
Also known as GHSA-8j5p-6pf5-6pqc.