CVE-2026-74802 SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy
Attackers can hijack WebSocket connections to proxy network traffic through the victim's machine, enabling network pivoting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-74802?
CVE-2026-74802 is a high-severity vulnerability in siyuan-note siyuan, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.
Weakness: CWE-346
Which versions are affected by CVE-2026-74802?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260803045322-cb67e0b4fab5 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260803045322-cb67e0b4fab5 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260803045322-cb67e0b4fab5 |
How do I fix CVE-2026-74802?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260803045322-cb67e0b4fab5 or later.
Is CVE-2026-74802 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74802 exists.
Sources
Also known as GHSA-3cc2-h3v6-rqpq, GO-2026-6650.