—

GO-2026-6430

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel

Quick fix

GO-2026-6430 — github.com/siyuan-note/siyuan/kernel: upgrade to the fixed version with the command below.

go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260726004013-64c26e74bb82

Details

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/siyuan-note/siyuan/kernel

Introduced in: 0Fixed in: 0.0.0-20260726004013-64c26e74bb82

Fixgo get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260726004013-64c26e74bb82

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4[ADVISORY]
https://github.com/siyuan-note/siyuan/commit/64c26e74bb82c24a73513107684b91cc01335fab[WEB]