Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck

CVE-2026-93591SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go

High 7.6

In plain English

A high-severity SQL injection in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 75.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.8.3

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

GitHub Security Advisory (GHSA-5rwv-4j4c-f954) vendor-advisory
VulnCheck Advisory: SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go third-party-advisory