Authenticated network pivot via WebSocket origin bypass

Cross-site WebSocket hijacking in SiYuan before 3.7.4 allows remote attackers to proxy network traffic through an admin session. The admin-only /ws/network/proxy endpoint upgrades browser WebSocket requests after overriding gorilla/websocket CheckOrigin to always return true, and it decodes attacker-supplied query parameters into the outbound target URL and forwarded headers. Exploitation requires SiYuan to be running and an administrator with an active session to visit a malicious page; if browser cookie handling permits the handshake, the kernel can be driven as an authenticated network pivot to localhost or internal services reachable from the victim machine.