CVE-2026-69084: SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.3 - Configuration
Ensure publish authentication is enabled, since when publish authentication is disabled anonymous users can reach /api/search/searchEmbedBlock.
SiYuan publish authentication = disabled - Configuration
Harden /api/search/searchEmbedBlock so client-supplied SQL is not passed verbatim to the main read-write siyuan.db handle (the vulnerability exists because it allows stacked statements to read/modify across all opened cleartext notebooks).
SiYuan endpoint access control for /api/search/searchEmbedBlock = restricted to single-statement, read-only, or admin
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69084?
CVE-2026-69084 has a critical severity rating of 10.
How do I fix CVE-2026-69084?
To fix CVE-2026-69084, upgrade SiYuan to version 3.7.3 or later.
What is the impact of CVE-2026-69084?
CVE-2026-69084 allows for SQL Injection which can compromise the siyuan.db database.
Which versions of SiYuan are affected by CVE-2026-69084?
SiYuan versions 3.7.2 and earlier are affected by CVE-2026-69084.
What kind of vulnerability is CVE-2026-69084?
CVE-2026-69084 is categorized as an SQL Injection vulnerability.