Executive brief
SiYuan is a popular note-taking and knowledge-management application that supports templates and attribute views for organizing content. An attacker can craft a malicious document or package containing specially crafted template columns that execute arbitrary SQL queries against a user's local database when the package is imported and rendered. This allows reading of all notebook data, including password-protected content, and potentially modifying data through SQL stacking attacks.
Technical details
The vulnerability is a second-order server-side template injection (SSTI) combined with SQL injection in SiYuan's attribute-view (AV) system. Attribute-view template columns are re-evaluated on every render and expose the `queryBlocks` function, which executes raw SQL against the read-write database handle using string substitution (the `?` placeholder is replaced with the argument string directly) rather than parameterized bind parameters. Although AV creation is admin-gated, the injection vector is the template content itself: an attacker creates a malicious AV with a template column containing `.action{queryBlocks "SELECT * FROM blocks WHERE root_id='<target>'"}` and distributes it as a shareable document or package. When a victim imports and renders the AV, the queryBlocks SQL executes with full database access, reading protected content or (via SQL statement stacking on the go-sqlite3 fork) writing data. The SSTI surface is otherwise hardened (env, expandenv, getHostByName are blocked), but queryBlocks remains an unauthenticated live-evaluation sink. Patched version 0.0.0-20260723035036-0a176345e02a parameterizes the queryBlocks function.
Affected products
- SiYuan SiYuan < 0.0.0-20260723035036-0a176345e02a
Timeline
- 2026-07-23: disclosed
- 2026-07-23: patched: Patch released as 0.0.0-20260723035036-0a176345e02a
- 2026-09-03: advisory