CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

What is CVE-2026-69084?

CVE-2026-69084 is a critical SQL injection vulnerability in siyuan-note siyuan, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

Weakness: CWE-89

Which versions are affected by CVE-2026-69084?

3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.

How do I fix CVE-2026-69084?

Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260721002947-23a17d44b5f3 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-69084 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69084 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vh22-h7hf-www7, GO-2026-6377.