What’s Vulnerable › Vulnerabilities

CVE-2026-72807: SiYuan before v3.7.4 SQL Injection via queryBlocks template

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-10-24
• Weakness: CWE-89

Description

SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or packages with crafted template columns that execute arbitrary SQL on a victim's kernel when the package is imported and rendered, enabling read and write access across notebooks.

Affected products

• siyuan-note siyuan: before 3.7.4 — fixed in 3.7.4

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.7.4. Check the vendor advisory for mitigations.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3
• https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-template

Get alerted when CVE-2026-72807 or the next vulnerability affects your stack