Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-93591

SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

siyuan-note siyuan

Default version status: unaffected

  • 0 to < 3.8.3affected
  • 3.8.3unaffected
pkg:golang/github.com/siyuan-note/siyuan/kernel

References