SiYuan fixes prompt-injection path to SSH keys and cloud credentials

SiYuan has fixed a prompt-injection path that could steer its AI Agent into copying SSH keys, cloud credentials and other sensitive local files into a workspace. The vulnerability, tracked as CVE-2026-82233, sat inside the application's native Model Context Protocol upload tool.

VulnCheck published the CVE record on 28 August, assigning a medium-severity score of 6.9 under CVSS 4.0. SiYuan version 3.8.1 contains the fix. The case is a useful example of how indirect prompt injection becomes a data-loss path when an agent can read local files and move them through a trusted tool.

How the MCP upload path exposed local files

SiYuan is an open-source knowledge-management application with an AI Agent and native MCP tools. Its asset.upload action accepts a block identifier and a comma-separated list of file paths, then copies those files into the workspace's assets directory.

In versions through 3.8.0, the handler converted every supplied value into an absolute path and passed it to the local-asset import function. The source remained outside SiYuan's sensitive-path checks. The downstream function opened the requested file and wrote its contents into workspace assets.

That created a direct chain from attacker-controlled content to a privileged local operation:

1. The agent processes a malicious instruction hidden in a web page, note or other untrusted content.
2. The instruction tells the agent to call asset.upload with a sensitive absolute path.
3. The user reviews the tool arguments and approves the local-write action.
4. Once approved, SiYuan opens the local file and copies it into the workspace.
5. The copied asset becomes available through normal note, export or synchronisation paths.

The GitHub security advisory demonstrates the path with files such as .ssh/id_rsa, .aws/credentials and /etc/passwd. The agent already had a legitimate upload capability. Prompt injection supplied the dangerous argument.

Visible arguments still needed enforced policy

SiYuan marked the upload action as a local write, which placed it behind user confirmation. The tagged version 3.8.0 source shows that the confirmation rendered the complete tool arguments, including the files source path, before the user approved the action.

That visibility supported an informed review, but it left the sensitive-path decision with the user. A request for a workspace image and a request for a private SSH key reached the same function. Once approved, the backend accepted either source because it had no sensitive-path restriction at that boundary.

The vulnerability was therefore an enforcement failure in the upload handler. SiYuan presented the parameter, but the server did not reject a sensitive value. Prompt injection could convert an approved tool call into a high-impact confidentiality event.

What SiYuan changed in version 3.8.1

SiYuan committed the fix on 13 August and released version 3.8.1 on 18 August. The patched handler validates upload paths before the import function opens them.

The new validation rejects paths covered by SiYuan's sensitive-path controls. The accompanying tests confirm rejection for locations including a user's .ssh/id_rsa and the workspace's conf/conf.json, while preserving ordinary asset uploads. The CVE record lists versions before 3.8.1 as affected and 3.8.1 as unaffected.

The fix addresses the product defect. The wider lesson applies to every agent with file, shell, email, database or network tools: enforcement must evaluate the proposed operation and its arguments before execution. Tool names alone are too broad to express action risk.

How this applies to Promptective

Promptective puts organisation policy at supported AI interaction and action boundaries. It detects prompt injection, secrets, PII, unsafe content and policy violations, then combines the finding with the proposed operation before returning an explicit outcome: allow, audit, sanitise, require approval or block.

For a chain like CVE-2026-82233, the decisive checkpoint is the moment an agent proposes moving a sensitive local file. At a supported, integrated action path, Promptective can stop a governed high-risk action before side effects, or hold it for approval under a rule that evaluates the proposed operation and its arguments. Security receives an explicit policy decision at the boundary.

Promptective produces content-minimised decision evidence for Security and Compliance: the applicable policy version, matched rules, finding stage and outcome. The owning application must separately record and verify approval and execution. Together, those records show the policy decision and the resulting action state without routinely retaining the prompt, response or file contents.

Practical takeaways for security teams

1. Upgrade SiYuan to 3.8.1 or later. The release contains the sensitive-path validation associated with CVE-2026-82233.
2. Treat tool arguments as security context. Evaluate source path, destination, data class and operation together.
3. Pair approvals with enforcement. Show the exact file and proposed action, then apply policy to sensitive paths before execution.
4. Inspect indirect inputs. Web pages, notes, retrieved documents and tool results can carry instructions into an agent session.
5. Record execution state. Preserve the policy decision and whether the file movement occurred as separate, content-minimised facts.

CVE-2026-82233 connects prompt injection to a concrete local-file boundary. On supported integrations, Promptective governs the interaction and proposed action with organisation policy before side effects occur.

See Promptective in action

Sources

• SiYuan GitHub Security Advisory GHSA-p23f-cm6q-2qp8, published 13 August 2026.
• CVE-2026-82233 record, published 28 August 2026.
• VulnCheck advisory, published 28 August 2026.
• SiYuan fix commit, 13 August 2026.
• SiYuan v3.8.1 release, 18 August 2026.