What’s Vulnerable › Vulnerabilities

CVE-2026-69084: SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-03 · updated 2026-10-23
• Weakness: CWE-89

Description

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

Affected products

• siyuan-note siyuan: before 3.7.3 — fixed in 3.7.3

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.7.3. Check the vendor advisory for mitigations.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7
• https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock

Get alerted when CVE-2026-69084 or the next vulnerability affects your stack