The vulnerability in SiYuan allows an authenticated attacker to make the server request arbitrary URLs through the built‑in network forward proxy, WebSocket proxy, or SSE proxy. The isPrivateIP check fails to block IPv6 transition addresses that map to private IPv4 destinations, enabling the attacker to target internal services and cloud metadata endpoints. This results in a full‑read SSRF that can expose credentials, internal network topology, and arbitrary service data.

SiYuan before version 3.7.4, as identified by the vendor "siyuan-note". Only devices running an affected version with SafeMode enabled are vulnerable.

The CVSS score of 6.9 indicates a medium‑to‑high severity. With SafeMode enabled, an attacker controls input via proxy endpoints, making exploitation straightforward once authenticated. No EPSS data is available, but the lack of a KEV listing does not preclude real‑world exploitation. The attack vector is internally scoped; success depends on network configuration and the attacker’s ability to access the proxy endpoints.