CVE-2026-74802: SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.7.4 - Configuration
Remove/undo the behavior where CheckOrigin unconditionally returns true to restore origin validation for the admin-only /ws/network/proxy endpoint (vulnerable in SiYuan versions before 3.7.4).
SiYuan /ws/network/proxy endpoint CheckOrigin = unconditionally return true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74802?
CVE-2026-74802 has a severity rating of high, with a score of 8.2.
How do I fix CVE-2026-74802?
To fix CVE-2026-74802, upgrade to SiYuan version 3.7.4 or later.
What type of vulnerability is CVE-2026-74802?
CVE-2026-74802 is a cross-site WebSocket hijacking vulnerability found in SiYuan.
Which versions of SiYuan are affected by CVE-2026-74802?
SiYuan versions before 3.7.4 are affected by CVE-2026-74802.
What is the impact of CVE-2026-74802?
CVE-2026-74802 allows attackers to hijack WebSocket connections through malicious webpages.