CVE-2026-101091GHSA-67p9-hm94-xwf3
SiYuan before v3.8.4 SQL Injection via Block Query Embed
siyuan-note siyuan
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 29 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.8.4siyuanCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.
Text from CVE List
Affected versions 2
- siyuanaffected: all versions before 3.8.4CVE List
- siyuanunaffected: 3.8.4CVE List