CVE-2026-100642 Overview
CVE-2026-100642 is a cross-site request forgery (CSRF) vulnerability in SiYuan, an open-source personal knowledge management application. The flaw exists in the CheckAuth lock-screen pass-through branch, which grants administrator access to loopback requests without validating Origin headers. Affected versions span from v2.1.0 up to but not including v3.8.4. Attackers can host a malicious web page that triggers zero-credential cross-origin requests from a victim's browser against the local SiYuan kernel. The weakness is tracked under CWE-346: Origin Validation Error.
Critical Impact
Successful exploitation lets attackers terminate the SiYuan kernel process, read workspace configuration and proxy settings, and invoke administrative actions without any credentials.
Affected Products
- SiYuan v2.1.0 through versions prior to v3.8.4
- SiYuan desktop deployments exposing the kernel on loopback
- SiYuan workspaces running the lock-screen authentication branch
Discovery Timeline
- 2026-09-26 - CVE-2026-100642 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100642
Vulnerability Analysis
SiYuan exposes its kernel over an HTTP interface bound to the loopback address. The CheckAuth middleware contains a pass-through branch intended to support the lock-screen workflow for local users. That branch treats loopback origins as trusted and skips Origin header validation. Any browser running on the victim's host can therefore reach the kernel API without supplying credentials. The server also fails to enforce SameSite controls or anti-CSRF tokens on sensitive endpoints.
Root Cause
The root cause is improper origin validation [CWE-346]. The lock-screen pass-through logic grants administrator privileges to any request that arrives on the loopback interface, regardless of the cross-origin context. Because browsers freely issue cross-origin requests to 127.0.0.1, the loopback assumption does not establish trust. The missing Origin and Referer checks allow attacker-controlled pages to act as the authenticated user.
Attack Vector
Exploitation requires a victim to visit a malicious or compromised web page while SiYuan is running locally. The page issues cross-origin HTTP requests to the SiYuan kernel endpoint on 127.0.0.1. The kernel accepts those requests, invokes privileged handlers, and returns workspace data. Attackers can terminate the kernel process, enumerate workspace configuration, read proxy settings, and trigger further administrative actions. User interaction is limited to loading the attacker's page. See the GitHub Security Advisory GHSA-9gpj-3rm3-x42m and the VulnCheck Advisory for SiYuan for additional technical context.
Detection Methods for CVE-2026-100642
Indicators of Compromise
- Unexpected shutdown events for the SiYuan kernel process on user workstations.
- Browser history or proxy logs showing requests to 127.0.0.1 on the SiYuan kernel port originating from external third-party sites.
- Workspace configuration or proxy settings read or modified without a corresponding user-initiated action.
Detection Strategies
- Inspect SiYuan kernel access logs for API calls whose Referer or Origin headers point to untrusted external domains.
- Correlate browser process activity with loopback traffic to the SiYuan kernel port to surface cross-origin invocations.
- Alert on administrative API calls, including kernel shutdown and configuration read endpoints, that occur outside active user sessions.
Monitoring Recommendations
- Monitor endpoint telemetry for the SiYuan process lifecycle, flagging unexpected termination followed by restart.
- Capture outbound DNS and HTTP telemetry from browsers to identify pages that script requests toward loopback services.
- Track SiYuan version strings across managed endpoints to confirm every instance is at v3.8.4 or later.
How to Mitigate CVE-2026-100642
Immediate Actions Required
- Upgrade all SiYuan installations to v3.8.4 or later across every workstation.
- Restrict browser access to high-risk or untrusted sites while legacy SiYuan versions remain in use.
- Audit SiYuan workspace configuration and proxy settings for unauthorized modifications after upgrade.
Patch Information
The maintainers resolved CVE-2026-100642 in SiYuan v3.8.4. The fix adds Origin header validation to the CheckAuth lock-screen pass-through branch, so loopback requests originating from third-party web contexts are rejected. Patch details and the full advisory are available in GitHub Security Advisory GHSA-9gpj-3rm3-x42m.
Workarounds
- Stop the SiYuan kernel when the application is not actively in use to eliminate the exposed loopback endpoint.
- Use a dedicated browser profile for general web browsing, separate from any session that interacts with the local SiYuan kernel.
- Block outbound requests from browsers to the SiYuan kernel port using a local firewall or browser extension until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
