Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw S

Severity: low · CVSS 3.1 · Published 2026-08-03

Technologies: github.com/siyuan-note/siyuan (Go). Vendors: Go.

Executive brief

Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

Affected products

Go github.com/siyuan-note/siyuan

Related threats

SiYuan SQL injection in fullTextSearchAssetContent endpoint
GO-2026-4721 - SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for ) in github.com/siyuan-note/siyuan
GO-2026-4708 - SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan