SiYuan bug can let attackers read and edit notebooks
SiYuan is a note-taking app. A security flaw lets an attacker send a rigged search request that runs their own database commands, letting them read or change notes in any notebook that is not encrypted.
- Severity
- CriticalCVSS 3.1 · 10.0
- Fix
- Fixed in 0.0.0-20260721002947-23a17d44b5f3Fix recorded on Aug 26, 2026
- Affected versions
- before 0.0.0-20260721002947-23a17d44b5f3
- Weakness
- CWE-89SQL Injection
- Exploit likelihood
- 1.1% in 30 daysEPSS, higher than 64% of known flaws
- Affects
- SiYuan
How it works
A search feature inside SiYuan lets a request carry a full database command instead of just search words, and SiYuan runs that command directly against the live notebook database without checking that it is safe or read-only.
What to do
Open SiYuan and check the version in Settings, About; if it is v3.7.2 or earlier you are exposed, and risk is higher if publish sharing is turned.
Update to SiYuan v3.7.3 or later, which fixes the flaw, and until you update, turn off publish sharing or require login for it.
Technical details
The /api/search/searchEmbedBlock endpoint passes a client-supplied SQL statement verbatim to the main read-write siyuan.db connection, with no restriction to a single statement or to read-only queries. It is gated only by CheckAuth, so a publish-mode RoleReader token, or an anonymous publish visitor when publish authentication is disabled, can reach it. Because the underlying driver executes stacked statements, an attacker can chain extra SQL onto the search query to read or modify content across every opened cleartext notebook.
Encrypted per-box notebooks are excluded. Fixed in v3.7.3.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Changed Impact crosses a security authority boundary
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Open in FIRST.org calculatorReferences
- github.com · GHSA-vh22-h7hf-www7 vendor advisory
- nvd.nist.gov · CVE-2026-69084 vdb entry
- vulncheck.com · siyuan-before-sql-injection-via-searchembedblock NVD GitHub Advisory
- github.com · commit 0015cba GitHub Advisory
- github.com · commit 23a17d4 GitHub Advisory