GHSA-4pjc-pwgq-q9jp: SiYuan has an SSTI via /api/template/renderSprig

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-55660

SiYuan has an SSTI via /api/template/renderSprig

Moderate severity GitHub Reviewed Published Dec 11, 2024 in siyuan-note/siyuan • Updated Dec 11, 2024

Package

gomod github.com/siyuan-note/siyuan/kernel (Go)

Affected versions

<= 0.0.0-20241210012039-5129ad926a21

Summary

Siyuan’s /api/template/renderSprig endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables

Impact

Information leakage

References

• GHSA-4pjc-pwgq-q9jp
• siyuan-note/siyuan@e70ed57

Published to the GitHub Advisory Database

Dec 11, 2024

Last updated

Dec 11, 2024