GO · SEPTEMBER 2026 · EARLY WARNING

SiYuan Arbitrary SQL Execution Vulnerability: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
siyuan (go)
Affected versions
>= v3.7.3-beta.2, <= v3.7.3-beta.2 or >= v3.7.3-beta.1, <= v3.7.3-beta.1 or >= v3.7.0-rc.2, <= v3.7.0-rc.2 or >= v3.7.0-rc.1, <= v3.7.0-rc.1 or >= v3.6.5, <= v3.6.5 or >= v3.7.0-dev12, <= v3.7.0-dev12 or >= v3.7.0-dev8, <= v3.7.0-dev8 or >= v3.7.0-dev5, <= v3.7.0-dev5 or >= v3.7.0-dev2, <= v3.7.0-dev2 or >= v3.6.5-dev2, <= v3.6.5-dev2 or >= v3.6.4, <= v3.6.4 or >= v3.6.4-dev2, <= v3.6.4-dev2 or >= v3.6.3, <= v3.6.3 or >= v3.6.2, <= v3.6.2 or >= v3.6.1, <= v3.6.1 or >= v3.6.0, <= v3.6.0 or >= v3.5.10, <= v3.5.10 or >= v3.5.9, <= v3.5.9 or >= v3.5.8, <= v3.5.8 or >= v3.5.8-dev2, <= v3.5.8-dev2 or >= v3.5.7, <= v3.5.7 or >= v3.5.5, <= v3.5.5 or >= v3.5.4, <= v3.5.4 or >= v3.5.4-dev5, <= v3.5.4-dev5 or >= v3.5.4-dev3, <= v3.5.4-dev3 or >= v3.5.4-dev2, <= v3.5.4-dev2 or >= v3.5.4-dev1, <= v3.5.4-dev1 or >= v3.5.3, <= v3.5.3 or >= v3.5.3-dev5, <= v3.5.3-dev5 or >= v3.5.3-dev4, <= v3.5.3-dev4 or >= v3.5.3-dev3, <= v3.5.3-dev3 or >= v3.5.3-dev2, <= v3.5.3-dev2 or >= v3.5.2, <= v3.5.2 or >= v3.5.2-dev2, <= v3.5.2-dev2 or >= v3.5.2-dev1, <= v3.5.2-dev1 or >= v3.5.1, <= v3.5.1 or >= v3.5.1-dev2, <= v3.5.1-dev2 or >= v3.5.1-dev1, <= v3.5.1-dev1 or >= v3.5.0, <= v3.5.0 or >= v3.5.0-dev2, <= v3.5.0-dev2 or >= v3.5.0-dev1, <= v3.5.0-dev1 or >= v3.4.2, <= v3.4.2 or >= v3.4.2-dev1, <= v3.4.2-dev1 or >= v3.4.1, <= v3.4.1 or >= v3.4.1-dev1, <= v3.4.1-dev1 or >= v3.4.0, <= v3.4.0 or >= v3.4.0-dev5, <= v3.4.0-dev5 or >= v3.4.0-dev4, <= v3.4.0-dev4 or >= v3.4.0-dev3, <= v3.4.0-dev3 or >= v3.4.0-dev2, <= v3.4.0-dev2 or >= v3.4.0-dev1, <= v3.4.0-dev1 or >= v3.3.6, <= v3.3.6 or >= v3.3.6-dev2, <= v3.3.6-dev2 or >= v3.3.6-dev1, <= v3.3.6-dev1 or >= v3.3.5, <= v3.3.5 or >= v3.3.4, <= v3.3.4 or >= v3.3.4-dev2, <= v3.3.4-dev2 or >= v3.3.4-dev1, <= v3.3.4-dev1 or >= v3.3.3, <= v3.3.3 or >= v3.3.3-dev5, <= v3.3.3-dev5 or >= v3.3.3-dev4, <= v3.3.3-dev4 or >= v3.3.3-dev3, <= v3.3.3-dev3 or >= v3.3.3-dev2, <= v3.3.3-dev2 or >= v3.3.3-dev1, <= v3.3.3-dev1 or >= v3.3.2, <= v3.3.2 or >= v3.3.2-dev2, <= v3.3.2-dev2 or >= v3.3.2-dev1, <= v3.3.2-dev1 or >= v3.3.1, <= v3.3.1 or >= v3.3.0, <= v3.3.0 or >= v3.3.0-dev4, <= v3.3.0-dev4 or >= v3.3.0-dev3, <= v3.3.0-dev3 or >= v3.2.1, <= v3.2.1 or >= v3.2.1-dev6, <= v3.2.1-dev6 or >= v3.2.1-dev5, <= v3.2.1-dev5 or >= v3.2.1-dev4, <= v3.2.1-dev4 or >= v3.2.1-dev3, <= v3.2.1-dev3 or >= v3.2.1-dev2, <= v3.2.1-dev2 or >= v3.2.0-dev10, <= v3.2.0-dev10 or >= v3.2.0-dev9, <= v3.2.0-dev9 or >= v3.2.0-dev8, <= v3.2.0-dev8 or >= v3.2.0-dev6, <= v3.2.0-dev6 or >= v3.2.0-dev4, <= v3.2.0-dev4 or >= v3.2.0-dev3, <= v3.2.0-dev3 or >= v3.2.0-dev2, <= v3.2.0-dev2 or >= v3.2.0-dev1, <= v3.2.0-dev1 or >= v3.1.32, <= v3.1.32 or >= v3.1.32-dev2, <= v3.1.32-dev2 or >= v3.1.31, <= v3.1.31 or >= v3.1.30, <= v3.1.30 or >= v3.1.30-dev1, <= v3.1.30-dev1 or >= v3.1.29, <= v3.1.29 or >= v3.1.29-dev3, <= v3.1.29-dev3 or >= v3.1.28, <= v3.1.28 or >= v3.1.28-dev3, <= v3.1.28-dev3 or >= v3.1.28-dev2, <= v3.1.28-dev2 or >= v3.1.27, <= v3.1.27 or >= v3.1.27-dev4, <= v3.1.27-dev4 or >= v3.1.27-dev2, <= v3.1.27-dev2 or >= v3.1.27-dev1, <= v3.1.27-dev1 or >= v3.1.26, <= v3.1.26 or >= v3.1.26-dev3, <= v3.1.26-dev3 or >= v3.1.26-dev2, <= v3.1.26-dev2 or >= v3.1.26-dev1, <= v3.1.26-dev1 or >= v3.1.25, <= v3.1.25 or >= v3.1.25-dev6, <= v3.1.25-dev6 or >= v3.1.25-dev4, <= v3.1.25-dev4 or >= v3.1.25-dev3, <= v3.1.25-dev3 or >= v3.1.24, <= v3.1.24 or >= v3.1.23, <= v3.1.23 or >= v3.1.22, <= v3.1.22 or >= v3.1.22-dev2, <= v3.1.22-dev2 or >= v3.1.22-dev1, <= v3.1.22-dev1 or >= v3.1.21, <= v3.1.21 or >= v3.1.21-dev4, <= v3.1.21-dev4 or >= v3.1.21-dev3, <= v3.1.21-dev3 or >= v3.1.21-dev1, <= v3.1.21-dev1 or >= v3.1.20, <= v3.1.20 or >= v3.1.20-dev4, <= v3.1.20-dev4 or >= v3.1.20-dev3, <= v3.1.20-dev3 or >= v3.1.19, <= v3.1.19 or >= v3.1.19-dev3, <= v3.1.19-dev3 or >= v3.1.18, <= v3.1.18 or >= v3.1.17, <= v3.1.17 or >= v3.1.16, <= v3.1.16 or >= v3.1.15, <= v3.1.15 or >= v3.1.15-dev3, <= v3.1.15-dev3 or >= v3.1.15-dev1, <= v3.1.15-dev1 or >= v3.1.14, <= v3.1.14 or >= v3.1.14-dev2, <= v3.1.14-dev2 or >= v3.1.13, <= v3.1.13 or >= v3.1.12, <= v3.1.12 or >= v3.1.12-dev4, <= v3.1.12-dev4 or >= v3.1.12-dev3, <= v3.1.12-dev3 or >= v3.1.12-dev2, <= v3.1.12-dev2 or >= v3.1.11, <= v3.1.11 or >= v3.1.11-dev9, <= v3.1.11-dev9 or >= v3.1.11-dev5, <= v3.1.11-dev5 or >= v3.1.11-dev2, <= v3.1.11-dev2 or >= v3.1.10, <= v3.1.10 or >= v3.1.10-dev6, <= v3.1.10-dev6 or >= v3.1.10-dev1, <= v3.1.10-dev1 or >= v3.1.9, <= v3.1.9 or >= v3.1.9-dev10, <= v3.1.9-dev10 or >= v3.1.9-dev9, <= v3.1.9-dev9 or >= v3.1.9-dev7, <= v3.1.9-dev7 or >= v3.1.9-dev6, <= v3.1.9-dev6 or >= v3.1.9-dev4, <= v3.1.9-dev4 or >= v3.1.9-dev3, <= v3.1.9-dev3 or >= v3.1.9-dev2, <= v3.1.9-dev2 or >= v3.1.9-dev1, <= v3.1.9-dev1 or >= v3.1.8, <= v3.1.8 or >= v3.1.8-dev3, <= v3.1.8-dev3 or >= v3.1.8-dev2, <= v3.1.8-dev2 or >= v3.1.7, <= v3.1.7 or >= v3.1.7-dev8, <= v3.1.7-dev8 or >= v3.1.7-dev7, <= v3.1.7-dev7 or >= v3.1.7-dev5, <= v3.1.7-dev5 or >= v3.1.7-dev4, <= v3.1.7-dev4 or >= v3.1.7-dev3, <= v3.1.7-dev3 or >= v3.1.6, <= v3.1.6 or >= v3.1.6-dev2, <= v3.1.6-dev2 or >= v3.1.6-dev1, <= v3.1.6-dev1 or >= v3.1.5, <= v3.1.5 or >= v3.1.4, <= v3.1.4 or >= v3.1.4-dev5, <= v3.1.4-dev5 or >= v3.1.4-dev3, <= v3.1.4-dev3 or >= v3.1.4-dev2, <= v3.1.4-dev2 or >= v3.1.3, <= v3.1.3 or >= v3.1.3-dev2, <= v3.1.3-dev2 or >= v3.1.3-dev1, <= v3.1.3-dev1 or >= v3.1.2, <= v3.1.2 or >= v3.1.2-dev4, <= v3.1.2-dev4 or >= v3.1.2-dev3, <= v3.1.2-dev3 or >= v3.1.2-dev2, <= v3.1.2-dev2 or >= v3.1.1-dev2, <= v3.1.1-dev2 or >= v3.1.1-dev1, <= v3.1.1-dev1 or >= v3.1.0, <= v3.1.0 or >= v3.1.0-dev12, <= v3.1.0-dev12 or >= v3.1.0-dev11, <= v3.1.0-dev11 or >= v3.1.0-dev10, <= v3.1.0-dev10 or >= v3.1.0-dev9, <= v3.1.0-dev9 or >= v3.1.0-dev8, <= v3.1.0-dev8 or >= v3.1.0-dev3, <= v3.1.0-dev3 or >= v3.1.0-dev2, <= v3.1.0-dev2 or >= v3.0.17, <= v3.0.17 or >= v3.0.17-dev2, <= v3.0.17-dev2 or >= v3.0.17-dev1, <= v3.0.17-dev1 or >= v3.0.16, <= v3.0.16 or >= v3.0.16-dev3, <= v3.0.16-dev3 or >= v3.0.15, <= v3.0.15 or >= v3.0.15-dev2, <= v3.0.15-dev2 or >= v3.0.15-dev1, <= v3.0.15-dev1 or >= v3.0.14, <= v3.0.14 or >= v3.0.13-dev4, <= v3.0.13-dev4 or >= v3.0.13-dev3, <= v3.0.13-dev3 or >= v3.0.12, <= v3.0.12 or >= v3.0.12-dev5, <= v3.0.12-dev5 or >= v3.0.12-dev4, <= v3.0.12-dev4 or >= v3.0.12-dev1, <= v3.0.12-dev1 or >= v3.0.11, <= v3.0.11 or >= v3.0.10, <= v3.0.10 or >= v3.0.10-dev3, <= v3.0.10-dev3 or >= v3.0.10-dev1, <= v3.0.10-dev1 or >= v3.0.9, <= v3.0.9 or >= v3.0.8, <= v3.0.8 or >= v3.0.8-dev2, <= v3.0.8-dev2 or >= v3.0.8-dev1, <= v3.0.8-dev1 or >= v3.0.7, <= v3.0.7 or >= v3.0.7-dev1, <= v3.0.7-dev1 or >= v3.0.6, <= v3.0.6 or >= v3.0.6-dev3, <= v3.0.6-dev3 or >= v3.0.6-dev2, <= v3.0.6-dev2 or >= v3.0.5, <= v3.0.5 or >= v3.0.5-dev5, <= v3.0.5-dev5 or >= v3.0.5-dev4, <= v3.0.5-dev4 or >= v3.0.5-dev3, <= v3.0.5-dev3 or >= v3.0.4, <= v3.0.4 or >= v3.0.4-dev2, <= v3.0.4-dev2 or >= v3.0.3, <= v3.0.3 or >= v3.0.3-dev5, <= v3.0.3-dev5 or >= v3.0.3-dev4, <= v3.0.3-dev4 or >= v3.0.2, <= v3.0.2 or >= v3.0.2-dev2, <= v3.0.2-dev2 or >= v3.0.1, <= v3.0.1 or >= v3.0.1-dev2, <= v3.0.1-dev2 or >= v3.0.0, <= v3.0.0 or >= v3.0.0-dev2, <= v3.0.0-dev2 or >= v3.0.0-dev1, <= v3.0.0-dev1 or >= v2.12.8, <= v2.12.8 or >= v2.12.8-dev2, <= v2.12.8-dev2 or >= v2.12.7, <= v2.12.7 or >= v2.12.7-dev2, <= v2.12.7-dev2 or >= v2.12.7-dev1, <= v2.12.7-dev1 or >= v2.12.6, <= v2.12.6 or >= v2.12.5, <= v2.12.5 or >= v2.12.4, <= v2.12.4 or >= v2.12.4-dev2, <= v2.12.4-dev2 or >= v2.12.3, <= v2.12.3 or >= v2.12.3-dev2, <= v2.12.3-dev2 or >= v2.12.2, <= v2.12.2 or >= v2.12.1, <= v2.12.1 or >= v2.12.1-dev3, <= v2.12.1-dev3 or >= v2.12.0, <= v2.12.0 or >= v2.12.0-dev1, <= v2.12.0-dev1 or >= v2.11.4, <= v2.11.4 or >= v2.11.4-dev6, <= v2.11.4-dev6 or >= v2.11.4-dev5, <= v2.11.4-dev5 or >= v2.11.4-dev4, <= v2.11.4-dev4 or >= v2.11.4-dev2, <= v2.11.4-dev2 or >= v2.11.3, <= v2.11.3 or >= v2.11.3-dev2, <= v2.11.3-dev2 or >= v2.11.3-dev1, <= v2.11.3-dev1 or >= v2.11.2, <= v2.11.2 or >= v2.11.2-dev5, <= v2.11.2-dev5 or >= v2.11.2-dev4, <= v2.11.2-dev4 or >= v2.11.2-dev3, <= v2.11.2-dev3 or >= v2.11.2-dev2, <= v2.11.2-dev2 or >= v2.11.2-dev1, <= v2.11.2-dev1 or >= v2.11.1, <= v2.11.1 or >= v2.11.1-dev1, <= v2.11.1-dev1 or >= v2.11.0, <= v2.11.0 or >= v2.11.0-dev2, <= v2.11.0-dev2 or >= v2.10.16, <= v2.10.16 or >= v2.10.16-dev2, <= v2.10.16-dev2 or >= v2.10.15, <= v2.10.15 or >= v2.10.15-dev1, <= v2.10.15-dev1 or >= v2.10.14, <= v2.10.14 or >= v2.10.14-dev2, <= v2.10.14-dev2 or >= v2.10.14-dev1, <= v2.10.14-dev1 or >= v2.10.13, <= v2.10.13 or >= v2.10.13-dev5, <= v2.10.13-dev5 or >= v2.10.13-dev1, <= v2.10.13-dev1 or >= v2.10.12, <= v2.10.12 or >= v2.10.12-dev1, <= v2.10.12-dev1 or >= v2.10.11, <= v2.10.11 or >= v2.10.11-dev2, <= v2.10.11-dev2 or >= v2.10.10, <= v2.10.10 or >= v2.10.9, <= v2.10.9 or >= v2.10.9-dev3, <= v2.10.9-dev3 or >= v2.10.8, <= v2.10.8 or >= v2.10.8-dev3, <= v2.10.8-dev3 or >= v2.10.8-dev2, <= v2.10.8-dev2 or >= v2.10.8-dev1, <= v2.10.8-dev1 or >= v2.10.6, <= v2.10.6 or >= v2.10.6-dev4, <= v2.10.6-dev4 or >= v2.10.6-dev3, <= v2.10.6-dev3 or >= v2.10.6-dev2, <= v2.10.6-dev2 or >= v2.10.6-dev1, <= v2.10.6-dev1 or >= v2.10.5, <= v2.10.5 or >= v2.10.5-dev2, <= v2.10.5-dev2 or >= v2.10.5-dev1, <= v2.10.5-dev1 or >= v2.10.4, <= v2.10.4 or >= v2.10.4-dev1, <= v2.10.4-dev1 or >= v2.10.3, <= v2.10.3 or >= v2.10.3-dev3, <= v2.10.3-dev3 or >= v2.10.3-dev2, <= v2.10.3-dev2 or >= v2.10.3-dev1, <= v2.10.3-dev1 or >= v2.10.2, <= v2.10.2 or >= v2.10.1, <= v2.10.1 or >= v2.10.1-dev1, <= v2.10.1-dev1 or >= v2.10.0, <= v2.10.0 or >= v2.9.9, <= v2.9.9 or >= v2.9.9-dev1, <= v2.9.9-dev1 or >= v2.9.8, <= v2.9.8 or >= v2.9.8-dev2, <= v2.9.8-dev2 or >= v2.9.8-dev1, <= v2.9.8-dev1 or >= v2.9.7, <= v2.9.7 or >= v2.9.7-dev3, <= v2.9.7-dev3 or >= v2.9.7-dev2, <= v2.9.7-dev2 or >= v2.9.6, <= v2.9.6 or >= v2.9.6-dev1, <= v2.9.6-dev1 or >= v2.9.5, <= v2.9.5 or >= v2.9.5-dev2, <= v2.9.5-dev2 or >= v2.9.4, <= v2.9.4 or >= v2.9.4-dev2, <= v2.9.4-dev2 or >= v2.9.3, <= v2.9.3 or >= v2.9.3-dev3, <= v2.9.3-dev3 or >= v2.9.3-dev1, <= v2.9.3-dev1 or >= v2.9.2, <= v2.9.2 or >= v2.9.2-dev3, <= v2.9.2-dev3 or >= v2.9.2-dev2, <= v2.9.2-dev2 or >= v2.9.1, <= v2.9.1 or >= v2.9.1-dev2, <= v2.9.1-dev2 or >= v2.9.1-dev1, <= v2.9.1-dev1 or >= v2.9.0, <= v2.9.0 or >= v2.9.0-dev1, <= v2.9.0-dev1 or >= v2.8.10, <= v2.8.10 or >= v2.8.9, <= v2.8.9 or >= v2.8.9-dev3, <= v2.8.9-dev3 or >= v2.8.9-dev2, <= v2.8.9-dev2 or >= v2.8.8, <= v2.8.8 or >= v2.8.8-dev3, <= v2.8.8-dev3 or >= v2.8.8-dev1, <= v2.8.8-dev1 or >= v2.8.7, <= v2.8.7 or >= v2.8.7-dev5, <= v2.8.7-dev5 or >= v2.8.7-dev3, <= v2.8.7-dev3 or >= v2.8.7-dev2, <= v2.8.7-dev2 or >= v2.8.6, <= v2.8.6 or >= v2.8.6-dev4, <= v2.8.6-dev4 or >= v2.8.6-dev2, <= v2.8.6-dev2 or >= v2.8.6-dev1, <= v2.8.6-dev1 or >= v2.8.5, <= v2.8.5 or >= v2.8.5-dev3, <= v2.8.5-dev3 or >= v2.8.5-dev2, <= v2.8.5-dev2 or >= v2.8.5-dev1, <= v2.8.5-dev1 or >= v2.8.4, <= v2.8.4 or >= v2.8.4-dev2, <= v2.8.4-dev2 or >= v2.8.3, <= v2.8.3 or >= v2.8.3-dev1, <= v2.8.3-dev1 or >= v2.8.1-dev3, <= v2.8.1-dev3 or >= v2.8.1-dev2, <= v2.8.1-dev2 or >= v2.8.1-dev1, <= v2.8.1-dev1 or >= v2.8.0, <= v2.8.0 or >= v2.8.0-dev1, <= v2.8.0-dev1 or >= v2.7.10, <= v2.7.10 or >= v2.7.9-dev2, <= v2.7.9-dev2 or >= v2.7.9-dev1, <= v2.7.9-dev1 or >= v2.7.9, <= v2.7.9 or >= v2.7.8, <= v2.7.8 or >= v2.7.8-dev1, <= v2.7.8-dev1 or >= v2.7.7, <= v2.7.7 or >= v2.7.7-dev4, <= v2.7.7-dev4 or >= v2.7.7-dev3, <= v2.7.7-dev3 or >= v2.7.7-dev2, <= v2.7.7-dev2 or >= v2.7.7-dev1, <= v2.7.7-dev1 or >= v2.7.6, <= v2.7.6 or >= v2.7.6-dev4, <= v2.7.6-dev4 or >= v2.7.6-dev3, <= v2.7.6-dev3 or >= v2.7.5, <= v2.7.5 or >= v2.7.5-dev2, <= v2.7.5-dev2 or >= v2.7.4, <= v2.7.4 or >= v2.7.4-dev1, <= v2.7.4-dev1 or >= v2.7.3, <= v2.7.3 or >= v2.7.3-dev4, <= v2.7.3-dev4 or >= v2.7.3-dev3, <= v2.7.3-dev3 or >= v2.7.2, <= v2.7.2 or >= v2.7.2-dev3, <= v2.7.2-dev3 or >= v2.7.2-dev2, <= v2.7.2-dev2 or >= v2.7.2-dev1, <= v2.7.2-dev1 or >= v2.7.1, <= v2.7.1 or >= v2.7.1-dev5, <= v2.7.1-dev5 or >= v2.7.1-dev1, <= v2.7.1-dev1 or >= v2.7.0, <= v2.7.0 or >= v2.6.3, <= v2.6.3 or >= v2.6.3-dev6, <= v2.6.3-dev6 or >= v2.6.3-dev4, <= v2.6.3-dev4 or >= v2.6.3-dev3, <= v2.6.3-dev3 or >= v2.6.3-dev2, <= v2.6.3-dev2 or >= v2.6.3-dev1, <= v2.6.3-dev1 or >= v2.6.2, <= v2.6.2 or >= v2.6.1, <= v2.6.1 or >= v2.6.1-dev7, <= v2.6.1-dev7 or >= v2.6.1-dev6, <= v2.6.1-dev6 or >= v2.6.1-dev5, <= v2.6.1-dev5 or >= v2.6.1-dev4, <= v2.6.1-dev4 or >= v2.6.1-dev3, <= v2.6.1-dev3 or >= v2.6.0, <= v2.6.0 or >= v2.6.0-dev3, <= v2.6.0-dev3 or >= v2.6.0-dev2, <= v2.6.0-dev2 or >= v2.6.0-dev1, <= v2.6.0-dev1 or >= v2.5.5, <= v2.5.5 or >= v2.5.5-dev1, <= v2.5.5-dev1 or >= v2.5.4, <= v2.5.4 or >= v2.5.4-dev1, <= v2.5.4-dev1 or >= v2.5.3, <= v2.5.3 or >= v2.5.3-dev2, <= v2.5.3-dev2 or >= v2.5.2, <= v2.5.2 or >= v2.5.2-dev2, <= v2.5.2-dev2 or >= v2.5.1, <= v2.5.1 or >= v2.5.1-dev2, <= v2.5.1-dev2 or >= v2.5.1-dev1, <= v2.5.1-dev1 or >= v2.5.0, <= v2.5.0 or >= v2.5.0-dev2, <= v2.5.0-dev2 or >= v2.5.0-dev1, <= v2.5.0-dev1 or >= v2.4.12, <= v2.4.12 or >= v2.4.12-dev2, <= v2.4.12-dev2 or >= v2.4.11, <= v2.4.11 or >= v2.4.10, <= v2.4.10 or >= v2.4.9, <= v2.4.9 or >= v2.4.8, <= v2.4.8 or >= v2.4.7, <= v2.4.7 or >= v2.4.6, <= v2.4.6 or >= v2.4.5, <= v2.4.5 or >= v2.4.4, <= v2.4.4 or >= v2.4.3, <= v2.4.3 or >= v2.4.2, <= v2.4.2 or >= v2.4.1, <= v2.4.1 or >= v2.4.0, <= v2.4.0 or >= v2.3.3, <= v2.3.3 or >= v2.3.2, <= v2.3.2 or >= v2.3.1, <= v2.3.1 or >= v2.3.0, <= v2.3.0 or >= v2.2.3, <= v2.2.3 or >= v2.2.2, <= v2.2.2 or >= v2.2.1, <= v2.2.1 or >= v2.2.0, <= v2.2.0 or >= v2.1.14, <= v2.1.14 or >= v2.1.13, <= v2.1.13 or >= v2.1.12, <= v2.1.12 or >= v2.1.11, <= v2.1.11 or >= v2.1.10, <= v2.1.10 or >= v2.1.9, <= v2.1.9 or >= v2.1.8, <= v2.1.8 or >= v2.1.8-dev1, <= v2.1.8-dev1 or >= v2.1.7, <= v2.1.7 or >= v2.1.6, <= v2.1.6 or >= v2.1.6-dev1, <= v2.1.6-dev1 or >= v2.1.5, <= v2.1.5 or >= v2.1.4, <= v2.1.4 or >= v2.1.3, <= v2.1.3 or >= v2.1.3-dev1, <= v2.1.3-dev1 or >= v2.1.2, <= v2.1.2 or >= v2.1.1, <= v2.1.1 or >= v2.1.0, <= v2.1.0 or >= v2.0.27, <= v2.0.27 or >= v2.0.26, <= v2.0.26 or >= v2.0.26-dev2, <= v2.0.26-dev2 or >= v2.0.26-dev1, <= v2.0.26-dev1 or >= v2.0.25, <= v2.0.25 or >= v2.0.24, <= v2.0.24 or >= v2.0.23, <= v2.0.23 or >= v2.0.22, <= v2.0.22 or >= v2.0.21, <= v2.0.21 or >= v2.0.21-dev1, <= v2.0.21-dev1 or >= v2.0.20, <= v2.0.20 or >= v2.0.19, <= v2.0.19 or >= v2.0.18, <= v2.0.18 or >= v2.0.17, <= v2.0.17 or >= dev2.0.17-2, <= dev2.0.17-2 or >= v2.0.16, <= v2.0.16 or >= v2.0.15, <= v2.0.15 or >= v2.0.14, <= v2.0.14 or >= v2.0.13, <= v2.0.13 or >= v2.0.12, <= v2.0.12 or >= v2.0.11, <= v2.0.11 or >= v2.0.10, <= v2.0.10 or >= v2.0.9, <= v2.0.9 or >= v2.0.8, <= v2.0.8 or >= v2.0.7, <= v2.0.7 or >= v2.0.6, <= v2.0.6 or >= v2.0.5, <= v2.0.5 or >= v2.0.4, <= v2.0.4 or >= v2.0.3, <= v2.0.3 or >= v2.0.2, <= v2.0.2 or >= v2.0.1, <= v2.0.1 or >= v2.0.0, <= v2.0.0 or >= v2.0.0-beta2, <= v2.0.0-beta2 or >= v2.0.0-beta1, <= v2.0.0-beta1 or >= v1.9.9, <= v1.9.9 or >= v1.9.8, <= v1.9.8 or >= v1.9.7, <= v1.9.7 or >= v1.9.6, <= v1.9.6 or >= v1.9.5, <= v1.9.5 or >= v1.9.4, <= v1.9.4 or >= v1.9.3, <= v1.9.3 or >= v1.9.2, <= v1.9.2 or >= v1.9.1, <= v1.9.1 or >= v1.9.0, <= v1.9.0 or >= v1.8.9, <= v1.8.9 or >= v1.8.8, <= v1.8.8 or >= v1.8.7, <= v1.8.7 or >= v1.8.6, <= v1.8.6 or >= v1.8.5, <= v1.8.5 or >= v1.8.4, <= v1.8.4 or >= v1.8.2, <= v1.8.2 or >= v1.8.1, <= v1.8.1 or >= v1.8.0, <= v1.8.0 or >= v1.7.11, <= v1.7.11 or >= v1.7.10, <= v1.7.10 or >= v1.7.9, <= v1.7.9 or >= v1.7.8, <= v1.7.8 or >= v1.7.7, <= v1.7.7 or >= v1.7.6, <= v1.7.6 or >= v1.7.5, <= v1.7.5 or >= v1.7.4, <= v1.7.4 or >= v1.7.3, <= v1.7.3 or >= v1.7.2, <= v1.7.2 or >= v1.7.1, <= v1.7.1 or >= v1.7.0, <= v1.7.0 or >= v1.6.3, <= v1.6.3 or >= v1.6.2, <= v1.6.2 or >= v1.6.1, <= v1.6.1 or >= v1.6.0, <= v1.6.0 or >= v1.5.6, <= v1.5.6 or >= v1.5.5, <= v1.5.5 or >= v1.5.5-beta3, <= v1.5.5-beta3 or >= v1.5.5-beta2, <= v1.5.5-beta2 or >= v1.5.5-beta1, <= v1.5.5-beta1 or >= v1.5.4, <= v1.5.4 or >= v1.5.3, <= v1.5.3 or >= v1.5.2, <= v1.5.2 or >= v1.5.1, <= v1.5.1 or >= v1.5.0, <= v1.5.0 or >= v1.4.8, <= v1.4.8 or >= v1.4.7, <= v1.4.7 or >= v1.4.6, <= v1.4.6 or >= v1.4.5, <= v1.4.5 or >= v1.4.4, <= v1.4.4 or >= v1.4.3, <= v1.4.3 or >= v1.4.2, <= v1.4.2 or >= v1.4.1, <= v1.4.1 or >= v1.4.0, <= v1.4.0 or >= v1.3.9, <= v1.3.9 or >= v1.3.8, <= v1.3.8 or >= v1.3.7, <= v1.3.7 or >= v1.3.6, <= v1.3.6 or >= v1.3.5, <= v1.3.5 or >= v1.3.4, <= v1.3.4 or >= v1.3.3, <= v1.3.3 or >= v1.3.2, <= v1.3.2 or >= v1.3.1, <= v1.3.1 or >= v1.3.0, <= v1.3.0 or >= v1.2.9, <= v1.2.9 or >= v1.2.8, <= v1.2.8 or >= v1.2.7, <= v1.2.7 or >= v1.2.6, <= v1.2.6 or >= v1.2.5, <= v1.2.5 or >= v1.2.31, <= v1.2.31 or >= v1.2.3, <= v1.2.3 or >= v1.2.2, <= v1.2.2 or >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.2.0-rc3, <= v1.2.0-rc3 or >= v1.2.0-rc2, <= v1.2.0-rc2 or >= v1.2.0-rc1, <= v1.2.0-rc1 or >= v1.2.0-beta16, <= v1.2.0-beta16 or >= v1.2.0-beta15, <= v1.2.0-beta15 or >= v1.2.0-beta14, <= v1.2.0-beta14 or >= v1.2.0-beta13, <= v1.2.0-beta13 or >= v1.2.0-beta12, <= v1.2.0-beta12 or >= v1.2.0-beta11, <= v1.2.0-beta11 or >= v1.2.0-beta10, <= v1.2.0-beta10 or >= v1.2.0-beta9, <= v1.2.0-beta9 or >= v1.2.0-beta8, <= v1.2.0-beta8 or >= v1.2.0-beta7, <= v1.2.0-beta7 or >= v1.2.0-beta6, <= v1.2.0-beta6 or >= v1.2.0-beta5, <= v1.2.0-beta5 or >= v1.2.0-beta4, <= v1.2.0-beta4 or >= v1.2.0-beta3, <= v1.2.0-beta3 or >= v1.2.0-beta2, <= v1.2.0-beta2 or >= v1.2.0-beta1, <= v1.2.0-beta1 or >= v1.1.83, <= v1.1.83 or >= v1.1.82, <= v1.1.82 or >= v1.1.81, <= v1.1.81 or >= v1.1.8, <= v1.1.8 or >= v1.1.7, <= v1.1.7 or >= v1.1.6, <= v1.1.6 or >= v1.1.5, <= v1.1.5 or >= v1.1.4, <= v1.1.4 or >= v1.1.3, <= v1.1.3 or >= v1.1.2, <= v1.1.2 or >= v1.1.1, <= v1.1.1 or >= v1.1.0, <= v1.1.0 or >= v1.0.9, <= v1.0.9 or >= v1.0.8, <= v1.0.8 or >= v1.0.7, <= v1.0.7 or >= v1.0.6, <= v1.0.6 or >= v1.0.5, <= v1.0.5 or >= v1.0.4, <= v1.0.4 or >= v1.0.3, <= v1.0.3 or >= v1.0.2, <= v1.0.2 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= v0.9.9, <= v0.9.9 or >= v0.9.8, <= v0.9.8 or >= v0.9.7, <= v0.9.7 or >= v0.9.6, <= v0.9.6 or >= v0.9.5, <= v0.9.5 or >= v0.9.2, <= v0.9.2 or >= v0.9.0, <= v0.9.0 or >= v0.8.5, <= v0.8.5 or >= v0.8.0, <= v0.8.0 or >= v0.7.8, <= v0.7.8 or >= v0.7.5, <= v0.7.5 or >= v0.7.1, <= v0.7.1 or >= v0.7.0, <= v0.7.0 or >= v0.6.8, <= v0.6.8 or >= v0.6.7, <= v0.6.7 or >= v0.6.6, <= v0.6.6 or >= v0.6.5, <= v0.6.5 or >= v0.6.4, <= v0.6.4 or >= v0.6.3, <= v0.6.3 or >= v0.6.2, <= v0.6.2 or >= v0.6.1, <= v0.6.1 or >= v0.6.0, <= v0.6.0 or >= v0.5.9, <= v0.5.9 or >= v0.5.8, <= v0.5.8 or >= v0.5.7, <= v0.5.7 or >= v0.5.6, <= v0.5.6 or >= v0.5.6-alpha1, <= v0.5.6-alpha1 or >= v0.5.5, <= v0.5.5 or >= v0.5.46, <= v0.5.46 or >= v0.5.45, <= v0.5.45 or >= v0.5.44, <= v0.5.44 or >= v0.5.43, <= v0.5.43 or >= v0.5.42, <= v0.5.42 or >= v0.5.41, <= v0.5.41 or >= v0.5.4, <= v0.5.4 or >= v0.5.3, <= v0.5.3 or >= v0.5.2, <= v0.5.2 or >= v0.5.1, <= v0.5.1 or >= v0.5.0, <= v0.5.0 or >= v0.4.94, <= v0.4.94 or >= v0.4.93, <= v0.4.93 or >= v0.4.92, <= v0.4.92 or >= v0.4.91, <= v0.4.91 or >= v0.4.9, <= v0.4.9 or >= v0.4.8, <= v0.4.8 or >= v0.4.7, <= v0.4.7 or >= v0.4.6, <= v0.4.6 or >= v0.4.5, <= v0.4.5 or >= v0.4.4, <= v0.4.4 or >= v0.4.32, <= v0.4.32 or >= v0.4.3-x1, <= v0.4.3-x1 or >= v0.4.3, <= v0.4.3 or >= v0.4.2, <= v0.4.2 or >= v0.4.1-x2, <= v0.4.1-x2 or >= v0.4.1, <= v0.4.1 or >= v0.4.0, <= v0.4.0 or >= v0.3.9, <= v0.3.9 or >= v0.3.8, <= v0.3.8 or >= v0.3.7, <= v0.3.7 or >= v0.3.6, <= v0.3.6 or >= v0.3.5, <= v0.3.5 or >= v0.3.4, <= v0.3.4 or >= v0.3.3, <= v0.3.3 or >= v0.3.2, <= v0.3.2 or >= v0.3.1, <= v0.3.1 or >= v0.3.0, <= v0.3.0 or >= v0.2.9, <= v0.2.9 or >= v0.2.8, <= v0.2.8 or >= v0.2.7, <= v0.2.7 or >= v0.2.6, <= v0.2.6 or >= v0.2.5, <= v0.2.5 or >= v0.2.4, <= v0.2.4 or >= v0.2.3, <= v0.2.3 or >= v0.2.2, <= v0.2.2 or >= v0.2.1, <= v0.2.1 or >= v0.2.0, <= v0.2.0 or >= v0.1.9, <= v0.1.9 or >= v0.1.8, <= v0.1.8 or >= v0.1.7, <= v0.1.7 or >= v0.1.6, <= v0.1.6 or >= v0.1.5, <= v0.1.5 or >= v0.1.4, <= v0.1.4 or >= v0.1.3, <= v0.1.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1 or >= v0.1.0, <= v0.1.0
Patched version
Not yet available
CVE-2026-69084GHSA-VH22-H7HF-WWW7

An early warning has been issued for a vulnerability in the SiYuan application that allows unauthenticated arbitrary SQL execution via the /api/search/searchEmbedBlock endpoint. This can lead to reading and writing content across all cleartext notebooks.

What happened

The SiYuan application is reportedly vulnerable to unauthenticated arbitrary SQL execution through its /api/search/searchEmbedBlock endpoint. This vulnerability arises because the application passes client-supplied SQL statements verbatim to the database without proper validation. An attacker could exploit this to execute arbitrary SQL commands, potentially leading to unauthorized reading and writing of content across all cleartext notebooks.

This vulnerability affects a wide range of SiYuan versions, from v0.1.0 to v3.7.3-beta.2, inclusive of all development and release candidate versions within this range. The issue has been tracked under CVE-2026-69084 and GHSA-VH22-H7HF-WWW7.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using any version of SiYuan from v0.1.0 to v3.7.3-beta.2, inclusive of all development and release candidate versions within this range.

What should I do right now?

Upgrade to a version of SiYuan that includes a fix for this vulnerability and ensure that the Publish.Auth.Enable setting is properly configured to restrict access. Monitor the primary sources for updates on patched versions and additional mitigations.

Is there an official fix available?

No official fix has been published yet. Continue to monitor the situation and apply any updates as they become available.

Sources

Join the 0Day waitlist →

← Back to all threats