{"action":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260813142104-b26a4a307b8a or later.","affected":[{"introduced":"0"}],"component":"github.com/siyuan-note/siyuan/kernel","cve_ids":["CVE-2026-82233"],"ecosystem":"Go","epss":0.00402,"exploited":false,"fixed_versions":["0.0.0-20260813142104-b26a4a307b8a"],"ghsa_id":"GHSA-p23f-cm6q-2qp8","id":"tcs_01M5KGVXV4KC1Y7C8J3CBSPG3S","modified_at":"2026-10-07T17:56:03.822617661Z","published_at":"2026-10-07T14:10:14Z","references":["https://osv.dev/vulnerability/GO-2026-6655","https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8","https://github.com/siyuan-note/siyuan/commit/b26a4a307b8ae5067387ea76ce1fad6b7f4bf9e7","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6655","url":"https://osv.dev/vulnerability/GO-2026-6655"}],"summary":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel"}