CVE-2026-72807: SiYuan before v3.7.4 SQL Injection via queryBlocks template
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or packages with crafted template columns that execute arbitrary SQL on a victim's kernel when the package is imported and rendered, enabling read and write access across notebooks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.7.4 - Compensating control
Prevent importing untrusted SiYuan documents/packages (especially ones containing crafted template columns that expose the queryBlocks function) until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72807?
The severity of CVE-2026-72807 is rated as high with a score of 8.
How do I fix CVE-2026-72807?
To fix CVE-2026-72807, update SiYuan to version 3.7.4 or later.
What type of vulnerability is CVE-2026-72807?
CVE-2026-72807 is classified as an SQL Injection vulnerability.
What versions of SiYuan are affected by CVE-2026-72807?
SiYuan versions before 3.7.4 are affected by CVE-2026-72807.
What kind of attacks can be executed using CVE-2026-72807?
CVE-2026-72807 allows attackers to execute SQL queries via malicious SiYuan documents or packages.