Vulnerability Description
SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7
- https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembed
FAQ
What is CVE-2026-69084?
CVE-2026-69084 is a vulnerability with a CVSS score of 10.0 (CRITICAL). SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read...
How severe is CVE-2026-69084?
CVE-2026-69084 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-69084?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.