Executive brief
SiYuan is a note-taking and knowledge management application that stores user notebooks in a local SQLite database. The `/api/search/searchEmbedBlock` endpoint accepts raw SQL statements from unauthenticated users in publish mode and executes them directly on the main read-write database without restriction. An attacker can exploit this to read all notebook content across the workspace, modify or delete notes, and manipulate files through SQL's ATTACH mechanism—without needing admin privileges, authentication tokens, or write permissions.
Technical details
The vulnerability is a missing authorization and input validation flaw in the `/api/search/searchEmbedBlock` endpoint (kernel/api/search.go). The endpoint accepts a `stmt` parameter containing raw SQL and passes it verbatim to `model.SearchEmbedBlock()` without any validation, then to `sql.SelectBlocksRawStmtNoParse()`, which executes it via the global `siyuan.db` handle in database.go. The endpoint is gated by `CheckAuth` only, which permits `RoleReader` tokens and anonymous access when `Publish.Auth.Enable` is false. The statement executes on a read-write database handle using the vendored `88250/go-sqlite3` driver, which supports stacked statements (`;`-separated), allowing arbitrary side effects including writes and ATTACH operations. Comparable endpoints (`/api/query/sql`, `fullTextSearchBlock`) enforce `CheckSingleStatement`, `CheckReadonlyStatement`, and `CheckAdminRole` checks—all absent here. A post-hoc filter (`FilterEmbedBlocksByPublishAccess`) runs after execution and cannot prevent write side effects. The attack requires network access to port 6808 (publish mode) with auth disabled or a valid reader token; no CSRF token or special user interaction is required. Encrypted per-notebook databases are not affected; code execution is not reachable in default builds lacking `load_extension`.
Affected products
- SiYuan SiYuan kernel < 0.0.0-20260721002947-23a17d44b5f3
Timeline
- 2026-09-03: disclosed: GitHub Security Advisory GHSA-vh22-h7hf-www7 published
- 2026-07-21: patched: Patched version 0.0.0-20260721002947-23a17d44b5f3 released
- 2026-09-03: other: Reviewed and confirmed by GitHub Security Advisory team