GO · AUGUST 2026 · EARLY WARNING

SiYuan SQL Injection Vulnerability: Critical CVE Under Investigation

Q: Am I affected?

If you are using SiYuan versions before v3.7.3, you may be affected by these SQL injection vulnerabilities.

Q: What should I do right now?

Upgrade to SiYuan v3.7.3 or later as soon as possible to mitigate the risk.

Q: Has this been exploited in the wild?

There is no evidence at this time that these vulnerabilities have been exploited in the wild.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: siyuan (go)
Affected versions: <= 0.0.0-20260313024916-fd6526133bb3
Patched version: Not yet available

GHSA-PQPF-6VQV-6W92GHSA-FPH3-GHQ9-VW66

An early warning has been issued for SiYuan versions before v3.7.3 which reportedly contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint. This could allow attackers to execute arbitrary SQL on the read-write asset-content database.

What happened

SiYuan versions before v3.7.3 are under investigation for containing SQL injection vulnerabilities. These vulnerabilities are located in the fullTextSearchAssetContent endpoint. Attackers could potentially execute arbitrary SQL on the read-write asset-content database, enabling them to read, modify, or delete cross-notebook data.

The vulnerabilities have been tracked under the IDs GHSA-PQPF-6VQV-6W92 and GHSA-FPH3-GHQ9-VW66. There is no evidence at this time that these vulnerabilities have been exploited in the wild. The issue was first flagged on 2026-08-03T15:32:48+00:00.

What to do about it

Upgrade to SiYuan v3.7.3 or later to mitigate the SQL injection vulnerabilities.
Review your SiYuan deployment to ensure it is running a version equal to or greater than v3.7.3.
Monitor the primary sources for updates on this vulnerability.
Consider implementing additional security measures to protect your asset-content database from potential SQL injection attacks.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using SiYuan versions before v3.7.3, you may be affected by these SQL injection vulnerabilities.

What should I do right now?

Upgrade to SiYuan v3.7.3 or later as soon as possible to mitigate the risk.

Has this been exploited in the wild?

There is no evidence at this time that these vulnerabilities have been exploited in the wild.

Sources

[GHSA-pqpf-6vqv-6w92] Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

Join the 0Day waitlist →

← Back to all threats