{"metadata": {"vulnerability": "cve-2026-74802", "count": 17, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-74802", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-16T12:59:42.223Z", "date_only": false, "value": "2026-08-16T12:59:42.223Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-74802", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-17T11:04:37.285Z", "date_only": false, "value": "2026-08-17T11:04:37.285Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-74802", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-17T11:16:40Z", "date_only": false, "value": "2026-08-17T11:16:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X8P6-569W-FMMR", "record": "GHSA-X8P6-569W-FMMR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-17T11:16:40.453Z", "date_only": false, "value": "2026-08-17T11:16:40.453", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74802", "record": "FKIE_CVE-2026-74802", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-17T12:32:21Z", "date_only": false, "value": "2026-08-17T12:32:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X8P6-569W-FMMR", "record": "GHSA-X8P6-569W-FMMR", "field": "published"}, {"timestamp": "2026-08-17T17:58:19.842Z", "date_only": false, "value": "2026-08-17T17:58:19.842311Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-74802", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-17T17:58:19.842Z", "date_only": false, "value": "2026-08-17T17:58:19.842311Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74802", "record": "FKIE_CVE-2026-74802", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-17T17:58:26.388Z", "date_only": false, "value": "2026-08-17T17:58:26.388Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-74802", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-28T13:45:55.771Z", "date_only": false, "value": "2026-08-28T13:45:55.771Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-74802", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-28T13:45:55.771Z", "date_only": false, "value": "2026-08-28T13:45:55.771Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-74802", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-28T16:18:24.673Z", "date_only": false, "value": "2026-08-28T16:18:24.673", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74802", "record": "FKIE_CVE-2026-74802", "field": "lastModified"}, {"timestamp": "2026-10-02T22:45:49Z", "date_only": false, "value": "2026-10-02T22:45:49Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X8P6-569W-FMMR", "record": "GHSA-X8P6-569W-FMMR", "field": "modified"}, {"timestamp": "2026-10-02T22:45:49Z", "date_only": false, "value": "2026-10-02T22:45:49Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-X8P6-569W-FMMR", "record": "GHSA-X8P6-569W-FMMR", "field": "withdrawn"}, {"timestamp": "2026-10-02T22:46:18Z", "date_only": false, "value": "2026-10-02T22:46:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3CC2-H3V6-RQPQ", "record": "GHSA-3CC2-H3V6-RQPQ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-02T22:46:18Z", "date_only": false, "value": "2026-10-02T22:46:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3CC2-H3V6-RQPQ", "record": "GHSA-3CC2-H3V6-RQPQ", "field": "modified"}, {"timestamp": "2026-10-03T09:30:30Z", "date_only": false, "value": "2026-10-03T09:30:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/e63235898447d307bd662749040b34de", "record": "CVE-2026-74802", "field": "creation_timestamp", "uuid": "25085a34-1a2d-4c72-91b1-312496cd1ea4", "content": "# CVE-2026-74802: CVE-2026-74802: Cross-Site WebSocket Hijacking (CSWSH) in SiYuan Knowledge Workspace\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-74802\n\n## Summary\nCVE-2026-74802 is a critical Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the SiYuan knowledge workspace application. Due to improper origin validation across multiple internal WebSocket endpoints, an attacker can hijack active authenticated sessions when a victim visits an untrusted external page. This allows the attacker to route malicious network traffic through the victim's localized SiYuan server, establishing an authenticated network pivot and facilitating Server-Side Request Forgery (SSRF).\n\n## TL;DR\nSiYuan is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) because its internal WebSocket handlers disable browser origin validation. This allows attackers to establish persistent tunnels, execute SSRF, and pivot into the victim's local network.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-346 (Origin Validation Error)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.2\n- **EPSS Score**: 0.00164\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan (Self-Hosted & Local Deployments)\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version 3.7.4 or higher to enforce origin verification checks.\n- Restrict network access to port 6806 using local firewall configurations.\n- Avoid browsing untrusted sites while keeping an active administrative session open in the background.\n\n**Remediation Steps:**\n1. Download and install the latest SiYuan release (version 3.7.4 or later) from the official repository.\n2. Verify the version update by accessing the internal configuration menu.\n3. Configure the application bound address to 127.0.0.1 to limit local loopback communication.\n\n## References\n\n- [GitHub Security Advisory (GHSA-3cc2-h3v6-rqpq)](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cc2-h3v6-rqpq)\n- [Official Fix Commit](https://github.com/siyuan-note/siyuan/commit/cb67e0b4fab57c9c5f458c1fd0df5ecf4417b696)\n- [CVE Record (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-74802)\n- [Third-Party Security Advisory (VulnCheck)](https://www.vulncheck.com/advisories/siyuan-cross-site-websocket-hijacking-via-network-proxy)\n- [SiYuan Release Tag v3.8.0](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-74802) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/e63235898447d307bd662749040b34de"}], "metrics": {"as_of": "2026-10-29T16:51:03.612Z", "anchors": {"origin": {"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-74802", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-74802", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 7577463.612598, "hours": 2104.8510034994447, "days": 87.70212514581019, "min_seconds": 7491063.612598, "max_seconds": 7577463.612598, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-74802", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T16:51:03.612Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}