Is CVE-2026-69085 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69085 being exploited in the wild.

How severe is CVE-2026-69085?

Low severity, with a CVSS score of 3.1, published 7 October 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0,fixed=0.0.0-20260721043339-eef10568384e; SiYuan <=v3.7.2.

Is there a fix for CVE-2026-69085?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721043339-eef10568384e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69085 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-69085?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69085: SiYuan unauthenticated SQL injection in searchDocs endpoint

Q: Is there a fix for CVE-2026-69085?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721043339-eef10568384e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-69085 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-69085?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69085 · Severity: low · CVSS 3.1 · Published 2026-10-07

SiYuan is a note-taking and knowledge management application. An unauthenticated attacker can inject SQL commands through the searchDocs endpoint when publish mode is enabled, allowing them to read and modify notes across all non-encrypted notebooks on the instance. The vulnerability requires no authentication, CSRF token, or write permissions.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-69085 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69085 being exploited in the wild.
How severe is CVE-2026-69085?: Low severity, with a CVSS score of 3.1, published 7 October 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0,fixed=0.0.0-20260721043339-eef10568384e; SiYuan <=v3.7.2.
Is there a fix for CVE-2026-69085?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721043339-eef10568384e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69085 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-69085?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721043339-eef10568384e or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260721043339-eef10568384e
```

Technical details

The /api/filetree/searchDocs endpoint concatenates unsanitized user input directly into SQL queries without escaping or parameter binding. The SQLite driver used executes stacked statements (separated by semicolons), enabling arbitrary SQL execution on a read-write database handle. The vulnerability affects all cleartext notebooks accessible through the global blocks table; encrypted notebooks are not exposed.

Affected products

SiYuan SiYuan <=v3.7.2

Identifiers

CVE-2026-69085
GHSA-33jq-p8c2-q3q4
GO-2026-6621

Timeline

2026-07-20: disclosed
2026-07-20: patched: v3.7.3 released

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.