Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck

CVE-2026-69083SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

Critical 10.0

In plain English

A critical-severity SQL injection in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260721004815-cf42dd5680c8	GHSA-fph3-ghq9-vw66
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260721004815-cf42dd5680c8	GO-2026-6374

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.3

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-fph3-ghq9-vw66) vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent third-party-advisory