~ / search / GHSA-4pjc-pwgq-q9jp

GHSA-4pjc-pwgq-q9jp

SiYuan has an SSTI via /api/template/renderSprig

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-55660

Packages

EcosystemPackageAffectedFixed in
Go github.com/siyuan-note/siyuan/kernel <= 0.0.0-20241210012039-5129ad926a21 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Siyuan's /api/template/renderSprig endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables ### Impact Information leakage

References

External links from the advisory. They lead to third-party sites.