GitHub 安全公告库 (GHSA)·2026-10-24 02:29· 3 小时前AI 评分52

SiYuan 发布模式过滤器 FilterLocalStorageByPublishAccess 仅清理三个键，匿名请求即可取回管理员存储数据

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

AI 导读

SiYuan 的 /api/storage/getLocalStorage、getLocalStorageVal 与 getLocalStorageVals 三个路由只挂 CheckAuth。