What is GHSA-pxf5-vpcp-gg52?

GHSA-pxf5-vpcp-gg52 is a security advisory published by GitHub Security Advisories with Medium severity. SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware...

Which CVE IDs does GHSA-pxf5-vpcp-gg52 cover?

GHSA-pxf5-vpcp-gg52 covers the following CVE IDs: CVE-2026-123492. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pxf5-vpcp-gg52?

GHSA-pxf5-vpcp-gg52 has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

GHSA-pxf5-vpcp-gg52MediumCVSS 4.9

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-123492 →

📋 Description

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2x3p-x74g-442x
https://nvd.nist.gov/vuln/detail/CVE-2026-123492
https://www.vulncheck.com/advisories/siyuan-before-3.8.9-nil-pointer-dereference-dos-via-mcp-resources-read
https://github.com/advisories/GHSA-pxf5-vpcp-gg52