7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33203

CVE-2026-33203: SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on attacker-controlled JSON. A remote attacker can send malformed messages that trigger a runtime panic, potentially crashing the kernel process and causing denial of service. Version 3.6.2 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33203

CVE-2026-33203:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/siyuan-note/siyuan/kernel	go	<= 3.6.1	3.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service in the SiYuan kernel's WebSocket server. The root cause is a combination of an authentication bypass and unsafe handling of user-controlled input. The analysis of kernel/server/serve.go reveals that the serveWebSocket function sets up the vulnerable environment. Within this function, an anonymous handler for WebSocket connections (server.serveWebSocket.func3) allows unauthenticated access if a specific query string is present in the connection URL. Once connected, another anonymous handler for messages (server.serveWebSocket.func7) processes incoming JSON data. This handler uses unchecked type assertions on the received data. An attacker can exploit this by first connecting to the WebSocket endpoint without authentication and then sending a malformed JSON payload. The unsafe type assertions in the message handler will fail, triggering a runtime panic that crashes the entire kernel process, resulting in a Denial of Service.

Vulnerable functions

server.serveWebSocket

kernel/server/serve.go

This function is responsible for initializing the WebSocket server and registering all the event handlers, including the vulnerable 'HandleConnect' and 'HandleMessage' handlers. It serves as the entry point for the vulnerable WebSocket functionality.

server.serveWebSocket.func3

kernel/server/serve.go

This anonymous function, acting as the 'HandleConnect' handler for the WebSocket server, contains the authentication bypass vulnerability. It allows a connection to be considered authenticated if the request URI contains a specific query string ("/ws?app=siyuan&id=auth&type=auth"), enabling unauthenticated access.

server.serveWebSocket.func7

kernel/server/serve.go

This anonymous function, acting as the 'HandleMessage' handler, processes incoming WebSocket messages. It uses unsafe type assertions to parse the JSON message without proper validation. An unauthenticated attacker, having connected via the auth bypass, can send a malformed payload (e.g., an empty JSON object '{}') that causes a type assertion failure, leading to a runtime panic and a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.