SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services.

SiYuan versions before v3.8.1 contain a server-side request forgery (SSRF) vulnerability affecting the http_request and web_fetch agent tools. The flaw stems from DNS resolution being performed only at guard time, without validating the IP address at connection time. Attackers can exploit this using a DNS rebinding technique, where the initial guard-time DNS query resolves to a legitimate public IP, but the subsequent connect-time query resolves to a private or cloud metadata IP. This time-of-check to time-of-use (TOCTOU) race condition effectively bypasses SiYuan's SSRF defenses. Successful exploitation allows attackers to access cloud instance metadata services (e.g., AWS IMDSv1) and internal network services that should be inaccessible. The vulnerability has been patched in SiYuan v3.8.1, which validates the resolved IP address at connection time as well.