Two more SiYuan MCP tool CVEs reach NVD: secret exfiltration via http_request and an incomplete file-tool blocklist
CVE-2026-59809 and CVE-2026-60083 were published to the National Vulnerability Database on 2026-08-22, both against the MCP tool surface of the SiYuan note-taking application and both fixed in v3.8.0, released 2026-08-12. The first covers secret placeholders being interpolated into the destination URL of the http_request MCP tool, letting an MCP client exfiltrate stored secrets to any host; the second covers an incomplete path blocklist in the MCP file tool that exposed publish-mode passwords and other protected workspace files. The underlying repository advisories were published 2026-08-08.
Two CVE records against the MCP tool surface of SiYuan, an open-source note-taking application whose kernel ships built-in MCP tools, were published to the National Vulnerability Database on 2026-08-22 with VulnCheck as the assigning CNA. Both were fixed in SiYuan v3.8.0, released 2026-08-12, ten days before the records appeared, and both were disclosed in repository advisories on 2026-08-08.
CVE-2026-59809 (GHSA-853m-gvvm-6rvx, CVSS 4.9) covers the
http_request MCP tool interpolating secret placeholders into the
tool's destination URL parameter. An MCP client could craft a request
whose URL contains secret placeholders and have SiYuan resolve them,
sending plaintext secret values to any public host without
confirmation. CVE-2026-60083 (GHSA-c8r8-95hg-mp34, CVSS 4.9) covers
the MCP file tool's path blocklist being incomplete relative to the
HTTP file API it was meant to align with: authenticated administrators
could read plaintext publish-mode passwords from
data/.siyuan/publishAccess.json and reach other protected workspace
files such as data/templates and data/snippets/conf.json.
These are the second and third MCP-tool records against SiYuan this
month. CVE-2026-74798, a path traversal in the application's
database_clean MCP tool, was published on 2026-08-18 and is covered
in our earlier story.
All three fixes shipped in the application's ordinary release train,
with v3.8.0 carrying both of the newly recorded corrections.
How was this verified, and what are the sources?
Published · last verified · confidence 1.00.
- SiYuan repository advisory GHSA-853m-gvvm-6rvx (published 2026-08-08, severity medium, CVSS 4.9) - secret placeholders in the http_request MCP tool are interpolated into the destination URL, enabling exfiltration of stored secrets to any attacker-chosen host; affects 3.7.3, patched in v3.8.0 - accessed
- SiYuan repository advisory GHSA-c8r8-95hg-mp34 (published 2026-08-08, severity medium, CVSS 4.9) - the MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files; affects 3.7.3, patched in v3.8.0 - accessed
- NVD records for CVE-2026-59809 and CVE-2026-60083, both published 2026-08-22 with VulnCheck as the assigning CNA - the first describes an MCP client crafting a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values to any public host without confirmation; the second describes authenticated administrators reading plaintext publish-mode passwords from data/.siyuan/publishAccess.json and accessing files like data/templates and data/snippets/conf.json - accessed
- SiYuan v3.8.0 release on GitHub, published 2026-08-12 - the patched version both advisories name - accessed