{"id":"ghsa-ghsa-xp3q-r38w-vgqm","seq":544318,"kind":"advisory","title":"SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized","url":"https://github.com/advisories/GHSA-xp3q-r38w-vgqm","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xp3q-r38w-vgqm","summary":"影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260729005258-4daee87d4152 → 0.0.0-20260729005258-4daee87d4152\nRelationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit 63c7d5474 resolved it by removing FilterUILayoutByPublishIgnore and nulling Conf.UILayout for readers. That fix is correct and complete for the live layout. This report concerns a different endpoint, a different filter function and a different storage backing. /api/storage/getLocalStorage reads data/storage/local.json rather than Conf.UILayout, and its filter FilterLocalStorageByPublishAcc…","severity":"medium","techs":["go","github"],"cves":[],"tags":["GHSA-xp3q-r38w-vgqm","github.com/siyuan-note/siyuan/kernel"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T18:29:45.000Z","fetched_at":"2026-10-23T18:42:53.259Z"}