CVE-2026-82234

SiYuan versions before v3.8.1 contain a server-side request forgery flaw (CWE-918) in the http_request and web_fetch agent tools, which enforce their SSRF guard by resolving the target hostname only once and never validating the IP address actually used when the connection is opened. An attacker exploits this with DNS rebinding: the guard-time DNS lookup returns a benign public IP that passes the filter, while the connect-time lookup returns a private or metadata address, so the request bypasses the defense entirely. A successful attack lets the attacker reach the cloud instance metadata service (potentially reading instance credentials where exposed) and access services on the host's internal network. Anyone running an affected self-hosted SiYuan server — especially on a cloud VM with a metadata endpoint — and allowing the agent tools to fetch attacker-chosen URLs is affected, with some user or agent interaction required per the CVSS UI:P metric. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates a 0.3% probability of exploitation within 30 days.

What to do: Upgrade SiYuan to v3.8.1 or later, which validates the connect-time resolution. Until upgraded, keep the http_request and web_fetch agent tools from fetching untrusted or attacker-chosen URLs and restrict their egress to block the metadata endpoint (169.254.169.254) and internal RFC1918 ranges. If the server runs on a cloud VM, audit and rotate any credentials reachable through the instance metadata service as a precaution.