CVE-2026-74799
CriticalCVSS 9.3Summary
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.
Risk Assessment
The risk is that sensitive data stored in memory, such as API keys and authentication codes, can be exposed, potentially leading to unauthorized system access.
Recommendation
It is recommended to upgrade SiYuan to version 3.7.4 or later and ensure the --mode flag is set to prod in production environments.
Original NVD description (English source)
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.