Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

SiYuan before 3.7.3 lets anyone run database commands

published 3 months ago
Summary

Versions of SiYuan released before 3.7.3 allow people without a login, or those with a read‑only publishing token, to send specially crafted requests that run their own database queries. This could let an attacker view, change, or delete data stored in the application’s notebooks. Updating to version 3.7.3 or later removes the problem, so apply the latest update as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Go siyuan-note github.com/siyuan-note/siyuan All versions
Original advisory text
Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fph3-ghq9-vw66. This link is maintained to preserve external references.

## Original Description
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-89SQL Injection
Timeline
Published3 Aug 2026
Updated3 Sep 2026
First seen3 Sep 2026
Sources
GHSA-pqpf-6vqv-6w92 · OSV
Track software like this
Free during beta