CVE-2026-93591: SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go
SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.3 - Compensating control
Restrict access to the getGraph endpoint so publish-mode readers/anonymous visitors cannot reach it, reducing exposure to the graph.go SQL injection.
Event History
Frequently Asked Questions
Who can exploit this issue?
A publish-mode reader or an anonymous visitor can exploit it through the getGraph endpoint. The attacker does not need user interaction, but the supplied severity vector indicates low privileges are required.
What is required to trigger the SQL injection?
The attacker needs to provide a crafted inline HTML span tag whose tag value contains SQL syntax, including a single quote. That value reaches the graph.go query2Stmt function and is concatenated into an SQL string literal without escaping.
What data or systems are at risk?
Successful exploitation can execute arbitrary queries against the read-write database and exfiltrate private data across notebooks. Confidentiality impact is rated high, with low integrity and availability impact.
Which versions need remediation?
SiYuan versions before 3.8.3 are affected. Updating to version 3.8.3 or later removes the affected version range identified in the advisory.