Go/github.com/siyuan-note/siyuan/kernel CVE-2026-33066: critical 9, EPSS 0.60%

SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

Action: Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260314111550-b382f50e1880 or later.

go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260314111550-b382f50e1880

Affected

Fixed versions

Sources

• osv: GHSA-4663-4mpg-879v
• nvd: CVE-2026-33066
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4663-4mpg-879v
• https://github.com/siyuan-note/siyuan/commit/b382f50e1880ed996364509de5a10a72d7409428
• https://github.com/siyuan-note/siyuan

CVE-2026-33066 · published 2026-03-18T16:09:24Z · modified 2026-07-08T07:14:01.052557197Z · JSON