{
  "schema_version": 1,
  "records": [
    {
      "schema_version": 1,
      "id": "4f6ec4a5-6ee4-4edc-991c-c6a80c1d69ba",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "e75e476c-3bc8-4132-b0e7-62290079c4ff",
      "source_run_id": "a145102a-b905-4e5d-8bea-ac92571b496c",
      "source_ticket_id": "CVE-2026-66012",
      "title": "SiYuan /mcp anonymous Publish arbitrary workspace file write",
      "summary": "The unauthenticated MCP file tool reachable through the anonymous Publish proxy allows writing arbitrary files anywhere inside the SiYuan workspace, including data/plugins, enabling planted plugin/code execution on the next desktop launch.",
      "target": {
        "canonical_repo_url": "https://github.com/siyuan-note/siyuan",
        "project_id": "e75e476c-3bc8-4132-b0e7-62290079c4ff",
        "product": "siyuan-note/siyuan",
        "version": "3.7.1",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "runtime": "siyuan-kernel",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [
        {
          "kind": "configuration",
          "description": "SiYuan Publish server enabled with anonymous access (Publish.Enable=true, Publish.Auth.Enable=false)"
        },
        {
          "kind": "network",
          "description": "Attacker can reach the Publish reverse proxy port (default 6808)"
        },
        {
          "kind": "runtime",
          "description": "MCP session obtained from the unauthenticated POST /mcp initialize response"
        }
      ],
      "evidence": [
        {
          "path": "logs/repro/mcp-write-response.log",
          "kind": "response"
        },
        {
          "path": "logs/repro/mcp-read-response.log",
          "kind": "response"
        },
        {
          "path": "logs/repro/mcp-conf-response.log",
          "kind": "response"
        },
        {
          "path": "logs/repro/siyuan-vuln-anon.log",
          "kind": "runtime_log",
          "sha256": "13ad56175d14657d87019b5c7b03f09290b11f63f86b7a463aff4a023c26c0a5"
        },
        {
          "path": "logs/repro/reproduction_steps.log",
          "kind": "runtime_log"
        },
        {
          "path": "logs/repro/mcp-init-response.log",
          "kind": "response",
          "sha256": "631fd13869a1784b4673c771cf3f595ab03ab75e0712aaf1c5d24904c9b3d993"
        },
        {
          "path": "logs/repro/mcp-plugin-json-write-response.log",
          "kind": "response",
          "sha256": "7228cec85b4f324cee69e700729a060e7eb45e37e099125d6ff69048a076c91b"
        },
        {
          "path": "logs/repro/mcp-plugin-index-write-response.log",
          "kind": "response",
          "sha256": "ed6bfdb958f073113eee85d878a8758720baf7a114c5a2e233a89cacb4c5be08"
        },
        {
          "path": "logs/repro/mcp-petals-write-response.log",
          "kind": "response",
          "sha256": "8bbd1e940dcb24548ba4c9204295577d3349252ef66a4bdc88724b848359e95d"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_observed",
      "provenance": {
        "source": "run",
        "actor_worker_id": "sandbox-worker-kimi27-gpt55-1",
        "derived_from_record_ids": []
      },
      "body": {
        "record_type": "primitive",
        "record": {
          "type": "arbitrary_write",
          "details": {
            "address_control": {
              "control": "full"
            },
            "value_control": "full",
            "max_bytes": 10485760,
            "repeatable": true
          }
        }
      },
      "fingerprint": "b7cfbe43fa433e325c86f2ff81fe815e67a969a37413c3ac7506673e6f541015",
      "created_at": "2026-07-27T00:49:59.835033Z",
      "updated_at": "2026-07-27T02:32:35.623568Z"
    },
    {
      "schema_version": 1,
      "id": "e5c0a6b3-3a84-412e-8264-dc771e5d528a",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "e75e476c-3bc8-4132-b0e7-62290079c4ff",
      "source_run_id": "a145102a-b905-4e5d-8bea-ac92571b496c",
      "source_ticket_id": "CVE-2026-66012",
      "title": "SiYuan /mcp plugin planting and execution via anonymous Publish",
      "summary": "Attacker-controlled plugin JavaScript executes inside the SiYuan kernel process after being planted through the unauthenticated /mcp file tool. The loaded plugin registers a new MCP tool that can be invoked remotely without authentication, demonstrating arbitrary code execution in the kernel plugin sandbox.",
      "target": {
        "canonical_repo_url": "https://github.com/siyuan-note/siyuan",
        "project_id": "e75e476c-3bc8-4132-b0e7-62290079c4ff",
        "product": "siyuan-note/siyuan",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [],
      "evidence": [
        {
          "path": "logs/repro/escalation-boot2.log",
          "kind": "runtime_log"
        },
        {
          "path": "logs/repro/escalation-plugin-tool-response.log",
          "kind": "request"
        },
        {
          "path": "logs/repro/escalation-plugin-tool-response.log",
          "kind": "response"
        },
        {
          "path": "logs/repro/escalation_experiment.log",
          "kind": "runtime_log"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_observed",
      "provenance": {
        "source": "run",
        "actor_worker_id": "sandbox-worker-kimi27-gpt55-1",
        "derived_from_record_ids": []
      },
      "body": {
        "record_type": "primitive",
        "record": {
          "type": "control_flow_influence",
          "details": {
            "target_control": {
              "control": "full"
            },
            "trigger": "Planting a plugin under data/plugins via the unauthenticated MCP file tool, enabling it in data/storage/petal/petals.json, and restarting the kernel so the plugin manager loads and executes the plugin's kernel.js; the attacker can then invoke plugin-defined MCP tools through POST /mcp",
            "repeatable": true
          }
        }
      },
      "fingerprint": "05000f19f6350977fa66091674d2fb4a2c1445d727c85dc8079c87e2d5ff4107",
      "created_at": "2026-07-27T00:53:59.588460Z",
      "updated_at": "2026-07-27T00:53:59.588460Z"
    },
    {
      "schema_version": 1,
      "id": "ae22b03a-9241-4839-894c-3df32bfb03cf",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "e75e476c-3bc8-4132-b0e7-62290079c4ff",
      "source_run_id": "a145102a-b905-4e5d-8bea-ac92571b496c",
      "source_ticket_id": "CVE-2026-66012",
      "title": "SiYuan /mcp planted desktop plugin JavaScript execution",
      "summary": "The unauthenticated /mcp file-write primitive can plant a SiYuan desktop plugin whose renderer JavaScript is evaluated by the real Electron desktop runtime. The planted plugin executed child_process and wrote a unique marker containing id output.",
      "target": {
        "canonical_repo_url": "https://github.com/siyuan-note/siyuan",
        "project_id": "e75e476c-3bc8-4132-b0e7-62290079c4ff",
        "product": "siyuan-note/siyuan",
        "version": "3.7.1",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "runtime": "siyuan-electron-desktop",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [
        {
          "kind": "configuration",
          "description": "Desktop plugin loading is enabled/trusted in the workspace configuration (bazaar.trust=true and petalDisabled=false)."
        },
        {
          "kind": "configuration",
          "description": "SiYuan v3.7.1 Publish server is enabled with anonymous access so /mcp initialize and tools/call are reachable through the Publish reverse proxy."
        },
        {
          "kind": "runtime",
          "description": "The real SiYuan Electron desktop runtime is launched with the same workspace after the attacker plants data/plugins/pruvexec/index.js and data/storage/petal/petals.json through /mcp."
        }
      ],
      "evidence": [
        {
          "path": "logs/repro/mcp-init-response.log",
          "kind": "response",
          "sha256": "069d5460418c1e6acdb19ab59ccb41214bce1a6ff682dc815daea6fd7405fd2d"
        },
        {
          "path": "logs/repro/mcp-plugin-index-write-response.log",
          "kind": "response",
          "sha256": "ed6bfdb958f073113eee85d878a8758720baf7a114c5a2e233a89cacb4c5be08"
        },
        {
          "path": "logs/repro/mcp-petals-write-response.log",
          "kind": "response",
          "sha256": "8bbd1e940dcb24548ba4c9204295577d3349252ef66a4bdc88724b848359e95d"
        },
        {
          "path": "logs/repro/siyuan-desktop-rce.log",
          "kind": "runtime_log",
          "sha256": "0a07b8dc9383aef54eeda9937914a792827e33c653e15fa53de67fc221b8c9b6"
        },
        {
          "path": "logs/repro/desktop-rce-marker-1785119383-51454.log",
          "kind": "marker_output",
          "sha256": "26d841ba45154c69323dff3d548458f8e76ac23e41125e142435d95a62c0ab87"
        },
        {
          "path": "logs/repro/desktop-rce-marker-1785119775-59728.log",
          "kind": "marker_output",
          "sha256": "61f6e393bf7ca3ede3df20985ed3bb93d2f858ed8c3c707192902c61091cd25c"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_observed",
      "provenance": {
        "source": "run",
        "actor_worker_id": "sandbox-worker-kimi27-gpt55-1",
        "derived_from_record_ids": []
      },
      "body": {
        "record_type": "primitive",
        "record": {
          "type": "control_flow_influence",
          "details": {
            "target_control": {
              "control": "full"
            },
            "trigger": "Plant data/plugins/pruvexec/index.js and data/storage/petal/petals.json via unauthenticated Publish-proxied /mcp, then launch the real SiYuan Electron desktop so the plugin loader evaluates attacker-controlled JavaScript.",
            "repeatable": true
          }
        }
      },
      "fingerprint": "db016224723b4430bd73aea6801170155b594318b0a19146d59c887cadcb26dc",
      "created_at": "2026-07-27T02:32:48.088297Z",
      "updated_at": "2026-07-27T02:37:01.262517Z"
    },
    {
      "schema_version": 1,
      "id": "bc1a0eac-5820-4049-a133-84053ae59f32",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "e75e476c-3bc8-4132-b0e7-62290079c4ff",
      "source_run_id": "a145102a-b905-4e5d-8bea-ac92571b496c",
      "source_ticket_id": "CVE-2026-66012",
      "title": "SiYuan anonymous Publish /mcp to desktop plugin command execution",
      "summary": "The unauthenticated Publish-proxied /mcp planting path composes with SiYuan desktop plugin loading to execute attacker-controlled JavaScript that invokes child_process and writes unique command markers in two fresh vulnerable desktop launches; fixed v3.7.2 blocks the same initial /mcp path without creating the marker.",
      "target": {
        "canonical_repo_url": "https://github.com/siyuan-note/siyuan",
        "project_id": "e75e476c-3bc8-4132-b0e7-62290079c4ff",
        "product": "siyuan-note/siyuan",
        "version": "3.7.1",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "runtime": "siyuan-electron-desktop",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [
        {
          "kind": "configuration",
          "description": "Desktop plugin loading is trusted/enabled in the workspace configuration."
        },
        {
          "kind": "configuration",
          "description": "SiYuan v3.7.1 Publish server is enabled with anonymous access so unauthenticated POST /mcp is reachable through the Publish reverse proxy."
        },
        {
          "kind": "runtime",
          "description": "The real SiYuan Electron desktop runtime is launched with the same workspace after plugin files are planted through /mcp."
        }
      ],
      "evidence": [
        {
          "path": "logs/repro/reproduction_steps.log",
          "kind": "runtime_log",
          "sha256": "9b2eeeab98856990de2f7c3560be635bf9a8285f845381346a5674e4b1c98019"
        },
        {
          "path": "logs/repro/mcp-init-response.log",
          "kind": "response",
          "sha256": "069d5460418c1e6acdb19ab59ccb41214bce1a6ff682dc815daea6fd7405fd2d"
        },
        {
          "path": "logs/repro/mcp-plugin-index-write-response.log",
          "kind": "response",
          "sha256": "ed6bfdb958f073113eee85d878a8758720baf7a114c5a2e233a89cacb4c5be08"
        },
        {
          "path": "logs/repro/mcp-petals-write-response.log",
          "kind": "response",
          "sha256": "8bbd1e940dcb24548ba4c9204295577d3349252ef66a4bdc88724b848359e95d"
        },
        {
          "path": "logs/repro/siyuan-desktop-rce.log",
          "kind": "runtime_log",
          "sha256": "0a07b8dc9383aef54eeda9937914a792827e33c653e15fa53de67fc221b8c9b6"
        },
        {
          "path": "logs/repro/desktop-rce-marker-1785119273-50730.log",
          "kind": "marker_output",
          "sha256": "be1191472ca07127010f755a07aadc16c1c0198df32b3d0950deb6995338ee89"
        },
        {
          "path": "logs/repro/desktop-rce-marker-1785119383-51454.log",
          "kind": "marker_output",
          "sha256": "26d841ba45154c69323dff3d548458f8e76ac23e41125e142435d95a62c0ab87"
        },
        {
          "path": "logs/repro/command-exec-negative-control.json",
          "kind": "negative_control",
          "sha256": "aa69dbbdd6e8f2be2516b3d6f5e2b0bc4b11c959085cedec98687ed2c66ad170"
        },
        {
          "path": "logs/repro/desktop-rce-marker-1785119719-59078.log",
          "kind": "marker_output",
          "sha256": "ebf7ceed207b487d428c151f076db3f99def1f174d204263278f92fecd649386"
        },
        {
          "path": "logs/repro/desktop-rce-marker-1785119775-59728.log",
          "kind": "marker_output",
          "sha256": "61f6e393bf7ca3ede3df20985ed3bb93d2f858ed8c3c707192902c61091cd25c"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_repeated",
      "provenance": {
        "source": "run",
        "actor_worker_id": "sandbox-worker-kimi27-gpt55-1",
        "derived_from_record_ids": []
      },
      "body": {
        "record_type": "derived_capability",
        "record": {
          "type": "command_execution",
          "details": {
            "attestation": "generic_runtime",
            "component_primitive_ids": [
              "ae22b03a-9241-4839-894c-3df32bfb03cf"
            ],
            "process_samples": [
              {
                "process_instance": "vuln-v3.7.1-desktop-run-1785119719-59078",
                "marker": "PRUVA_MCP_DESKTOP_RCE_1785119719-59078",
                "marker_evidence": {
                  "path": "logs/repro/desktop-rce-marker-1785119719-59078.log",
                  "kind": "marker_output",
                  "sha256": "ebf7ceed207b487d428c151f076db3f99def1f174d204263278f92fecd649386"
                }
              },
              {
                "process_instance": "vuln-v3.7.1-desktop-run-1785119775-59728",
                "marker": "PRUVA_MCP_DESKTOP_RCE_1785119775-59728",
                "marker_evidence": {
                  "path": "logs/repro/desktop-rce-marker-1785119775-59728.log",
                  "kind": "marker_output",
                  "sha256": "61f6e393bf7ca3ede3df20985ed3bb93d2f858ed8c3c707192902c61091cd25c"
                }
              }
            ],
            "negative_control": {
              "process_instance": "fixed-v3.7.2-anonymous-publish-control",
              "marker": "PRUVA_MCP_DESKTOP_RCE_FIXED_CONTROL_1785119775-59728",
              "observation_evidence": {
                "path": "logs/repro/command-exec-negative-control.json",
                "kind": "negative_control",
                "sha256": "aa69dbbdd6e8f2be2516b3d6f5e2b0bc4b11c959085cedec98687ed2c66ad170"
              }
            },
            "composition_evidence": [
              {
                "path": "logs/repro/reproduction_steps.log",
                "kind": "runtime_log",
                "sha256": "9b2eeeab98856990de2f7c3560be635bf9a8285f845381346a5674e4b1c98019"
              },
              {
                "path": "logs/repro/mcp-init-response.log",
                "kind": "response",
                "sha256": "069d5460418c1e6acdb19ab59ccb41214bce1a6ff682dc815daea6fd7405fd2d"
              },
              {
                "path": "logs/repro/mcp-plugin-index-write-response.log",
                "kind": "response",
                "sha256": "ed6bfdb958f073113eee85d878a8758720baf7a114c5a2e233a89cacb4c5be08"
              },
              {
                "path": "logs/repro/mcp-petals-write-response.log",
                "kind": "response",
                "sha256": "8bbd1e940dcb24548ba4c9204295577d3349252ef66a4bdc88724b848359e95d"
              },
              {
                "path": "logs/repro/siyuan-desktop-rce.log",
                "kind": "runtime_log",
                "sha256": "0a07b8dc9383aef54eeda9937914a792827e33c653e15fa53de67fc221b8c9b6"
              },
              {
                "path": "logs/repro/desktop-rce-marker-1785119719-59078.log",
                "kind": "marker_output",
                "sha256": "ebf7ceed207b487d428c151f076db3f99def1f174d204263278f92fecd649386"
              },
              {
                "path": "logs/repro/desktop-rce-marker-1785119775-59728.log",
                "kind": "marker_output",
                "sha256": "61f6e393bf7ca3ede3df20985ed3bb93d2f858ed8c3c707192902c61091cd25c"
              }
            ]
          }
        }
      },
      "fingerprint": "02acb484ba5090d33272e7aaa62b7f8adae93ce88b4039198c3b627e7d75343f",
      "created_at": "2026-07-27T02:34:19.616567Z",
      "updated_at": "2026-07-27T02:37:21.424793Z"
    }
  ]
}