What happened
Published 2026-09-26: an incomplete fix for an earlier path-guard flaw leaves protected-workspace files readable/exfiltratable/overwritable through recursive MCP file operations in SiYuan's agent, with the most dangerous action (file.grep) receiving no user confirmation.
Why it matters
Shows a recurring pattern in agent-integrated knowledge tools: MCP file tools that bypass one path guard open access to config, key material, and publish tokens — the helper surfaces agents are privileged to reach.
Attack vector
The sensitive-path denylist is applied only to the root of recursive MCP file operations, not per descendant: file.grep (globally classed 'safe', no per-call confirmation) returns lines from protected descendants; file.copy copies protected descendants to ordinary paths; unzip overwrites protected descendants with lexically-contained ZIP members.
Affected systems
SiYuan 3.8.0 through 3.8.3 (MCP file tool recursive operations). Fixed in 3.8.4.
Mitigation
Upgrade to SiYuan 3.8.4 (GHSA-9g6v-r3xf-673q); do not expose the MCP server to untrusted callers.