CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
- State
- Published
- Severity
- 9.9 Critical
- Published
- Aug 3, 2026
- Updated
- Aug 14, 2026
- Reserved
- Aug 3, 2026
Description
SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.9 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | VulnCheck |
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
siyuansiyuan-note |
|
References
- GitHub Security Advisory (GHSA-vh22-h7hf-www7)vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.3 SQL Injection via searchEmbedBlockthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.