SiYuan note-taking app can run SQL commands

Published September 3, 2026 CVE-2026-72807

SiYuan, a note-taking app, has a flaw that lets attackers run SQL commands on your device if they trick you into opening a malicious note. This can expose your data or even let them control parts of the app.

Severity
HighCVSS 3.1 · 8.0
Fix
Fixed in 0.0.0-20260723035036-0a176345e02aFix recorded on Sep 3, 2026
Affected versions
before 0.0.0-20260723035036-0a176345e02a
Weakness
CWE-89SQL Injection
Exploit likelihood
0.20% in 30 daysEPSS, higher than 10% of known flaws
Affects
SiYuan

How it works

If you open a note with a specially crafted template column, the app runs SQL commands on your device without asking.

What to do

Check whether the installed SiYuan version is older than 3.7.4.

Update SiYuan to 3.7.4 or newer. Then verify the installed version.

Technical details

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel. CVE: This vulnerability corresponds to CVE-2026-72807.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity High Attack depends on conditions outside the attacker's control
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source