Improper Neutralization of Special Elements Used in a Template Engine Affecting github.com/siyuan-note/siyuan/kernel/util package, versions <3.1.16-dev1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMSIYUANNOTESIYUANKERNELUTIL-8499639
- published12 Dec 2024
- disclosed11 Dec 2024
- creditElleuch-x1
Introduced: 11 Dec 2024
NewCVE-2024-55660 Â (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/siyuan-note/siyuan/kernel/util to version 3.1.16-dev1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the /api/template/renderSprig endpoint due to improper sanitization. An attacker can access environment variables by exploiting the Sprig template engine, despite its limitations.