SQL Injection in SiYuan via /api/search/searchEmbedBlock

SiYuan versions v3.7.2 and earlier are affected by a critical SQL injection vulnerability identified as CVE-2026-69084. The application exposes the /api/search/searchEmbedBlock endpoint, which fails to sanitize client-supplied SQL statements before passing them to the main read-write siyuan.db database handle. The implementation does not enforce read-only or admin-level restrictions on this endpoint, and it improperly validates authorization via the CheckAuth function.

Consequently, the vulnerability is accessible to users with minimal privileges, such as those holding a 'RoleReader' token, or even to anonymous users if publish authentication is disabled. Because the underlying database driver supports stacked queries, an attacker can execute arbitrary SQL commands. This allows for unauthorized reading and modification of data stored in all unencrypted notebooks within the SiYuan environment. The issue is resolved in version v3.7.3.

Impact

The successful exploitation of this vulnerability grants attackers the ability to read and modify sensitive content within unencrypted notebooks. Given the base CVSS score of 10.0, the impact is comprehensive regarding data integrity and confidentiality for the affected application instances. Any environment utilizing an outdated version of SiYuan, particularly those with enabled publish features, is at significant risk of unauthorized data manipulation.

Recommendation

• Upgrade all SiYuan installations to version v3.7.3 or later immediately to patch CVE-2026-69084.
• Audit webserver access logs for POST or GET requests targeting the /api/search/searchEmbedBlock path, specifically looking for anomalous query parameters containing SQL syntax (e.g., semicolons, 'DROP', 'UPDATE', 'UNION').
• Ensure that publish authentication is strictly enforced in any environment where SiYuan is exposed to a network.
• Monitor for unauthorized database modifications that deviate from standard user activity logs.