SiYuan <= v3.7.2 SQL Injection Vulnerability: Critical Threat
SiYuan versions <= v3.7.2 contain a critical SQL injection vulnerability (CVE-2026-69084) that allows attackers to read and modify content across all opened cleartext notebooks. Users of affected versions are strongly advised to upgrade to v3.7.3 or later.
What happened
SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no restrictions. This allows an attacker to execute arbitrary SQL statements, enabling them to read and modify content across all opened cleartext notebooks.
The vulnerability is tracked as CVE-2026-69084 and has a CVSS score of 10.0, indicating a critical severity level. The issue is fixed in SiYuan v3.7.3.
To assess your exposure, check if you are running SiYuan v3.7.2 or earlier. If so, upgrade to v3.7.3 or later immediately to mitigate the risk. For more details, consult the primary sources linked in the threat data.
How 0Day mitigates this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.