SiYuan MCP asset.upload 任意绝对路径读取漏洞

SiYuan Note's MCP tool asset.upload lacks workspace boundary validation and can read files at arbitrary absolute paths; affected versions are 3.8.0 and below, fixed in 3.8.1. This tool, at kernel/mcp/tools/asset.go:195, only normalizes paths with filepath.Abs and does not perform IsSubPath or IsSensitivePath checks; subsequently, InsertLocalAssets will os.Open these paths and copy their contents into the workspace assets/ directory. An attacker can use prompt injection to make the Agent call this tool with files such as /Users/victim/.ssh/id_rsa, ~/.aws/credentials, or /etc/passwd as the files parameter, while the confirmation dialog only shows a category-level prompt and does not display the real source path, making it difficult for users to make an informed decision.