SiYuan versions before 3.7.4 register several Go net/http/pprof debug endpoints—including heap and goroutine dumps—without requiring authentication when the application is not explicitly started in production mode. The exposed endpoints, such as /debug/pprof/heap, enable an attacker to retrieve in‑memory data that may contain secrets such as AccessAuthCode and AI provider API keys. This disclosure compromises sensitive credentials and can lead to further attacks if those keys are leveraged for external services.

The affected vendor is Siyuan Note, with the Siyuan desktop and server application before version 3.7.4. Any deployment running those older releases and not configured with the --mode prod flag is vulnerable.

The CVSS score of 9.2 indicates a critical risk. The vulnerability does not require authentication, making it trivially exploitable from any host with network or local access to the service. The EPSS score is not published, but the absence of any countermeasures and the lack of inclusion in the CISA KEV catalog imply that the threat remains significant. Attackers can use the exposed heap dumps to extract credentials, leading to potential lateral movement or service compromise.