Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

SiYuan templates can run unauthorized SQL code

CVE-2026-72807 · published 2 months ago
Summary

Older versions of SiYuan let specially crafted document templates execute database commands on the user's computer. An attacker could send a malicious document or package that, when opened, runs SQL to read or change notebook data. Upgrade SiYuan to version 3.7.4 or later to stop this behavior.

What to do
  • Update github.com siyuan-note to version 0.0.0-20260723035036-0a176345e02a.
  • Update siyuan-note github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260723035036-0a176345e02a.
  • Update siyuan-note siyuan to version 3.7.4 or later.
Affected software
Ecosystem VendorProductAffected versions
– siyuan-note siyuan < 3.7.4
go github.com siyuan-note < 0.0.0-20260723035036-0a176345e02a
Fix: upgrade to 0.0.0-20260723035036-0a176345e02a
Go siyuan-note github.com/siyuan-note/siyuan/kernel < 0.0.0-20260723035036-0a176345e02a
Fix: upgrade to 0.0.0-20260723035036-0a176345e02a
Original advisory text
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or packages with crafted template columns that execute arbitrary SQL on a victim's kernel when the package is imported and rendered, enabling read and write access across notebooks.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published12 Aug 2026
Updated4 Nov 2026
First seen12 Aug 2026
Sources
CVE-2026-72807 · NVD
CVE-2026-72807 · MITRE
GHSA-x67c-8pwr-m8g3 · GHSA
GO-2026-6410 · OSV
Track software like this
Free during beta