Executive brief
SiYuan is a popular note-taking and knowledge management application that allows users to organize and search documents. A critical SQL injection vulnerability in the backlink/mention search feature allows attackers to execute arbitrary SQL commands against the application's database, potentially exposing or modifying sensitive notes across all notebooks. An anonymous user or one with minimal read permissions can exploit this via a specially crafted search query, or via malicious document titles shared with victims.
Technical details
The vulnerability is a second-order SQL injection (CWE-89) in the backlink/mention search functionality. The root cause lies in the MATCH query construction in kernel/model/backlink.go, which concatenates stored block metadata (title, name, alias, anchor text) and client-supplied keywords without properly escaping single quotes—only double quotes are escaped. While the indexing code uses parameterized INSERTs to safely store metadata, the query reuse path concatenates these values directly into SQL. An attacker can inject a single quote to break out of the string literal and inject arbitrary SQL. The first-order vector requires only anonymous or RoleReader access (reachable via publish mode). The second-order vector exploits stored document metadata that detonates when that document is later queried by any user. Because the query executes on the global read-write siyuan.db handle through a statement-stacking-capable SQLite driver, attackers can stack multiple statements to achieve cross-notebook read disclosure, writes, and schema modifications. The fix, released in v3.7.4, requires parameterizing the keyword and metadata bindings rather than concatenating them.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-07-23: disclosed: Original advisory GHSA-q2vg-7qgx-x5fc published
- 2026-08-14: advisory: Duplicate advisory GHSA-p8cp-78hp-wmq8 published; CVE-2026-72811 issued
- 2026-08-14: patched: Patch released in v3.7.4
- 2026-09-03: other: Duplicate advisory GHSA-p8cp-78hp-wmq8 withdrawn