{"id":8875,"date":"2026-11-13T13:24:12","date_gmt":"2026-11-13T13:24:12","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read"},"modified":"2026-11-13T13:24:50","modified_gmt":"2026-11-13T13:24:50","slug":"cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read","title":{"rendered":"CVE-2026-123492: SiYuan before 3.8.9 nil pointer crash via MCP resources\/read"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A nil pointer dereference vulnerability in SiYuan versions before 3.8.9 allows authenticated attackers to crash the note-taking application&#8217;s kernel process by sending a specially crafted MCP resources\/read request.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> Nil pointer dereference in SiYuan&#8217;s privateCacheMiddleware when handling MCP resources\/read requests for nonexistent resources<\/li><li><strong>Who is affected:<\/strong> SiYuan users running versions 3.8.7 and 3.8.8; attackers need a valid API token<\/li><li><strong>CVSS score:<\/strong> 4.9 (Medium) according to NVD; 6.9 according to VulnCheck<\/li><li><strong>Fixed version:<\/strong> 3.8.9<\/li><li><strong>What to do:<\/strong> Upgrade to SiYuan 3.8.9 or later<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SiYuan is a note-taking application that supports MCP (Model Context Protocol) for AI integrations. A bug in versions 3.8.7 and 3.8.8 causes the program to crash when someone with a valid login token asks it to read a resource that does not exist. When the crash happens, the SiYuan server stops working for a few seconds (about 2.6 seconds in Docker) and restarts automatically. During that time, anyone using the app loses their connection. If you run SiYuan and use its MCP features, upgrade to version 3.8.9. If you do not use SiYuan or do not have MCP enabled, this does not affect you.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability exists in SiYuan&#8217;s privateCacheMiddleware function in kernel\/mcp\/server.go. When an authenticated client sends a resources\/read request for a nonexistent MCP resource in an initialized session, the go-sdk v1.8.0 library returns a typed nil pointer (*ReadResourceResult with a nil value) along with an error.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The middleware performs a type switch on the result and unconditionally dereferences the pointer to set cacheable.CacheScope = &#8220;private&#8221; without checking if the pointer is nil. This triggers a SIGSEGV panic (segmentation violation at address 0x18, the offset of the CacheScope field), causing the kernel process to exit immediately with exit code 2.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The issue was reported by xy3xy3 and documented in GitHub Security Advisory GHSA-2x3p-x74g-442x. The reporter observed the crash in Docker deployments, where the container exits and restarts automatically. During the restart window, all client connections are interrupted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SiYuan does not register any MCP resources by default (the capabilities object is empty and resources\/list returns an empty array), but the go-sdk always registers the resources\/read method handler. The SDK&#8217;s checkRequest function only validates that the method name is known, not whether resources are actually available, allowing the request to reach the vulnerable code path.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to SiYuan version 3.8.9, which patches the nil pointer dereference. The fix adds a nil check before dereferencing the result pointer in privateCacheMiddleware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you cannot upgrade immediately, restrict access to API tokens to trusted users only, as the vulnerability requires a valid API token to exploit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is a denial-of-service vulnerability that requires authentication. An attacker with a valid API token can repeatedly crash the SiYuan kernel, disrupting service for all users. In Docker deployments, the container restarts automatically, but the interruption lasts several seconds. In non-Docker deployments, the process exits and may require manual restart, potentially causing data loss if unsaved edits exist.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability affects automated workflows that use MCP to write content to SiYuan (such as ChatGPT or openai-mcp integrations). Failed write operations may be caused by the connection being terminated mid-request rather than receiving a proper error response.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The issue does not affect users who do not use MCP features or who do not expose their SiYuan API to untrusted parties.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/siyuan-note\/siyuan\/security\/advisories\/GHSA-2x3p-x74g-442x\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-2x3p-x74g-442x<\/a><\/li><li><a href=\"https:\/\/www.vulncheck.com\/advisories\/siyuan-before-3.8.9-nil-pointer-dereference-dos-via-mcp-resources-read\" target=\"_blank\" rel=\"noreferrer noopener\">VulnCheck Advisory: SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources\/read<\/a><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-123492\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-123492<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>SiYuan before 3.8.9 contains a nil pointer dereference in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources.<\/p>\n","protected":false},"author":2,"featured_media":8874,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"SiYuan versions 3.8.7 and 3.8.8","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: Authenticated DoS in SiYuan MCP handler","_nx_sec_type":"mcp","_nx_sec_vendor":"SiYuan","_nx_sec_fixed":"3.8.9","_nx_sec_action":""},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8875","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-123492: SiYuan MCP nil pointer crash fixed<\/title>\n<meta name=\"description\" content=\"CVE-2026-123492 in SiYuan before 3.8.9 lets authenticated attackers crash the kernel via MCP resources\/read. Upgrade to 3.8.9 to fix the nil pointer bug.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-123492: SiYuan MCP nil pointer crash fixed\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-123492 in SiYuan before 3.8.9 lets authenticated attackers crash the kernel via MCP resources\/read. Upgrade to 3.8.9 to fix the nil pointer bug.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T13:24:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-13T13:24:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-123492: SiYuan before 3.8.9 nil pointer crash via MCP resources\\\/read\",\"datePublished\":\"2026-11-13T13:24:12+00:00\",\"dateModified\":\"2026-11-13T13:24:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read\"},\"wordCount\":596,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read\",\"name\":\"CVE-2026-123492: SiYuan MCP nil pointer crash fixed\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp\",\"datePublished\":\"2026-11-13T13:24:12+00:00\",\"dateModified\":\"2026-11-13T13:24:50+00:00\",\"description\":\"CVE-2026-123492 in SiYuan before 3.8.9 lets authenticated attackers crash the kernel via MCP resources\\\/read. Upgrade to 3.8.9 to fix the nil pointer bug.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-123492: SiYuan before 3.8.9 nil pointer crash via MCP resources\\\/read\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-123492: SiYuan MCP nil pointer crash fixed","description":"CVE-2026-123492 in SiYuan before 3.8.9 lets authenticated attackers crash the kernel via MCP resources\/read. Upgrade to 3.8.9 to fix the nil pointer bug.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-123492: SiYuan MCP nil pointer crash fixed","og_description":"CVE-2026-123492 in SiYuan before 3.8.9 lets authenticated attackers crash the kernel via MCP resources\/read. Upgrade to 3.8.9 to fix the nil pointer bug.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read","og_site_name":"i10X News","article_published_time":"2026-11-13T13:24:12+00:00","article_modified_time":"2026-11-13T13:24:50+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-123492: SiYuan before 3.8.9 nil pointer crash via MCP resources\/read","datePublished":"2026-11-13T13:24:12+00:00","dateModified":"2026-11-13T13:24:50+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read"},"wordCount":596,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read","name":"CVE-2026-123492: SiYuan MCP nil pointer crash fixed","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp","datePublished":"2026-11-13T13:24:12+00:00","dateModified":"2026-11-13T13:24:50+00:00","description":"CVE-2026-123492 in SiYuan before 3.8.9 lets authenticated attackers crash the kernel via MCP resources\/read. Upgrade to 3.8.9 to fix the nil pointer bug.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123492-siyuan-before-3-8-9-nil-pointer-crash-via-mcp-resources-read#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-123492: SiYuan before 3.8.9 nil pointer crash via MCP resources\/read"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8875","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8875"}],"version-history":[{"count":1,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8875\/revisions"}],"predecessor-version":[{"id":8877,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8875\/revisions\/8877"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8874"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8875"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8875"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8875"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8875"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8875"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}