The vulnerability arises from SiYuan prior to version 3.8.0, where the http_request MCP tool incorrectly interpolates secret placeholders into the destination URL parameter. An attacker can craft an http_request with a user‑controlled URL containing secret placeholders, causing the running client to send the plaintext secret values to a public host. The result is a direct confidentiality breach, exposing stored secrets to any external server the attacker controls. Based on the description, the attack does not require additional confirmation, and the exfiltration occurs whenever the client processes the malicious http_request.

This issue affects all releases of Siyuan under the siyuan-note:siyuan CNA product line before version 3.8.0. Users operating any earlier 3.x series of the desktop application are potentially vulnerable.

The CVSS score of 6.9 reflects a medium‑severity risk. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploits at this time. The lack of detailed authentication prerequisites in the description suggests that simply delivering a malicious http_request to a vulnerable client suffices; however, an attacker would need to reach the target client to trigger the malicious request. Given the potential for remote secret exfiltration, applying the vendor patch or otherwise mitigating the affected functionality remains a priority.