{"action":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260813142104-b26a4a307b8a or later.","affected":[{"introduced":"0"}],"component":"github.com/siyuan-note/siyuan/kernel","cve_ids":["CVE-2026-82233"],"ecosystem":"Go","epss":0.00402,"exploited":false,"fixed_versions":["0.0.0-20260813142104-b26a4a307b8a"],"ghsa_id":"GHSA-p23f-cm6q-2qp8","id":"tcs_01M5KFGP259KQ8TH2AA04YV8ZT","modified_at":"2026-10-07T17:56:03.822617661Z","published_at":"2026-10-02T23:16:56Z","references":["https://osv.dev/vulnerability/GHSA-p23f-cm6q-2qp8","https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8","https://github.com/siyuan-note/siyuan/commit/b26a4a307b8ae5067387ea76ce1fad6b7f4bf9e7","https://github.com/siyuan-note/siyuan","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-p23f-cm6q-2qp8","url":"https://osv.dev/vulnerability/GHSA-p23f-cm6q-2qp8"}],"summary":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)"}