Starplatinu

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.0 **Description** The endpoint "/api/tag/getTag" is registered using only the `model.CheckAuth` middleware, missing the `model.CheckAdminRole` and `model.CheckReadonly` checks. This allows any authenticated user, including those with `RoleReader` or `RoleEditor` permissions on read-only workspaces, to perform unauthorized configuration writes. By providing a `sort` argument to the endpoint, an attacker can mutate `model.Conf.Tag.Sort` and trigger the `model.Conf.Save()` function, which atomically rewrites the entire workspace `conf.json` file. This can lead to the rollback of other legitimate configuration settings if a write-race occurs. **Recommendations** Update to version 3.7.0. As a temporary workaround, restrict access to the "/api/tag/getTag" endpoint to authorized administrators only.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.0 **Description** Broken access control in the publish-mode allows readers to enumerate metadata from documents that are invisible to the publish service. This occurs because certain search handlers do not filter responses for users with the `RoleReader` role, allowing them to bypass the trust boundary and access information from password-protected or publish-ignored notebooks. An attacker can enumerate all tag strings, asset filenames, widget names, and template names across the entire workspace. The affected API endpoints are: - '/api/search/searchTag' - '/api/search/searchTemplate' - '/api/search/searchWidget' - '/api/search/searchAsset' **Recommendations** Update to version 3.7.0. As a temporary workaround, restrict access to the '/api/search/searchTag', '/api/search/searchTemplate', '/api/search/searchWidget', and '/api/search/searchAsset' endpoints to minimize the risk of metadata enumeration.

**Name of the Vulnerable Software and Affected Versions** Kysely versions prior to 0.28.16 **Description** Improper input handling in the JSON-path compiler allows attackers to access sensitive JSON data. The software fails to escape JSON-path metacharacters such as `.`, `[`, `]`, `*`, `**`, and `?`, only doubling single quotes. When attacker-controlled input is passed to the `key()` or `at()` functions—including in type-safe code where columns are defined as `Record<string, T>`—attackers can use dots as path-leg separators to traverse into sibling and child fields outside the intended scope. This results in unauthorized read access and, in update statements, unauthorized write access to JSON sub-fields across MySQL, PostgreSQL (using `->$` or `->>$` operators), and SQLite. On MySQL and PostgreSQL, the use of `*` or `**` wildcards can be used to enumerate all values at a specific depth or recurse through the entire document. **Recommendations** As a temporary workaround, avoid using the `key()` or `at()` functions with attacker-controlled input in the affected API endpoints until a patch is available. Restrict the input passed to `key()` and `at()` to a known-good character set, rejecting any strings containing JSON-path metacharacters.