CVE-2026-69083 SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
Unauthenticated attackers can execute arbitrary SQL to read, modify, or delete cross-notebook data in SiYuan via the fullTextSearchAssetContent endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-69083?
CVE-2026-69083 is a critical SQL injection vulnerability in siyuan-note siyuan, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
Weakness: CWE-89
Which versions are affected by CVE-2026-69083?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260721004815-cf42dd5680c8 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260721004815-cf42dd5680c8 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260721004815-cf42dd5680c8 |
How do I fix CVE-2026-69083?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260721004815-cf42dd5680c8 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-69083 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69083 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-fph3-ghq9-vw66, GO-2026-6374.