Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

SiYuan allows attackers to read and change data via search

CVE-2026-69085 · published 11 days ago
Summary

The SiYuan note‑taking application lets anyone send a specially crafted search term that runs database commands. This can let an attacker view or modify notes in any notebook without logging in. Update SiYuan to version 3.7.3 or later to stop the issue.

What to do
  • Update github.com siyuan-note to version 0.0.0-20260721043339-eef10568384e.
  • Update siyuan-note github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260721043339-eef10568384e.
  • Update siyuan-note siyuan to version 3.7.3 or later.
Affected software
Ecosystem VendorProductAffected versions
– siyuan-note siyuan < 3.7.3
go github.com siyuan-note < 0.0.0-20260721043339-eef10568384e
Fix: upgrade to 0.0.0-20260721043339-eef10568384e
Go siyuan-note github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721043339-eef10568384e
Fix: upgrade to 0.0.0-20260721043339-eef10568384e
Original advisory text
SiYuan before v3.7.3 SQL Injection via searchDocs
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published7 Oct 2026
Updated15 Oct 2026
First seen3 Aug 2026
Sources
CVE-2026-69085 · NVD
CVE-2026-69085 · MITRE
GHSA-33jq-p8c2-q3q4 · GHSA
CVE-2026-69085 · OSV
GO-2026-6621 · OSV
Track software like this
Free during beta