{"id":"CVE-2026-69084","revision":null,"records":[{"revision":"ae157945770b4297ac9accc5fc966fa1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-69084","aliases":[],"title":"SiYuan before v3.7.3 SQL Injection via searchEmbedBlock","description":"SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.","state":0,"publishedAt":"2026-08-03T13:20:39.994+00:00","modifiedAt":"2026-08-14T16:51:12.135+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.3\"\n                        },\n                        {\n                            \"version\": \"3.7.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":9.9,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","score":10,"severity":"CRITICAL"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-69084","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-69084","identifiers":["CVE-2026-69084"]},"retained":false,"historicalAffected":[]},{"revision":"c18dc257c4204119bdf9f930031b9d2f","observedAt":"2026-10-25T15:18:51.467+00:00","statement":{"source":"nvd","id":"CVE-2026-69084","aliases":[],"title":"SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoi…","description":"SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.","state":0,"publishedAt":"2026-08-03T14:16:28.68+00:00","modifiedAt":"2026-10-23T21:10:00.157+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.9,"severity":"CRITICAL"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","score":10,"severity":"CRITICAL"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69084","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-89"],"productCriteria":[],"sourceDates":{"published":"2026-08-03T14:16:28.680","lastModified":"2026-10-23T21:10:00.157"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-69084","identifiers":["CVE-2026-69084"]},"retained":false,"historicalAffected":[]},{"revision":"b8da20edbb1a445d8a6233ac3e23a346","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-vh22-h7hf-www7","aliases":["CVE-2026-69084","GO-2026-6377"],"title":"SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write","description":"**CVE:** This vulnerability corresponds to [CVE-2026-69084](https://nvd.nist.gov/vuln/detail/CVE-2026-69084).\n\n### Summary\n\nThe `/api/search/searchEmbedBlock` endpoint passes a client-supplied SQL statement verbatim to the database with no validation. The endpoint is gated by `CheckAuth` only reachable by the publish RoleReader token, and by the anonymous account when `Publish.Auth.Enable` is `false`. The statement runs on the main read-write `siyuan.db` handle through a driver that executes stacked statements, with no single-statement or read-only guard. An unauthenticated request can therefore execute arbitrary SQL reading and writing content across all cleartext notebooks.\n\nUnlike SQL injection into a fixed query, this endpoint accepts a full SQL statement by design and simply fails to restrict who may call it or what the statement may do.\n\n### Details\n\nData flow verbatim, unvalidated:\n\n- `searchEmbedBlock` (`kernel/api/search.go`): `stmt := arg[\"stmt\"].(string)` passed directly to `model.SearchEmbedBlock(stmt, …)`. No validation.\n- `SearchEmbedBlock` → `SearchEmbedBlockInBox` → `sql.SelectBlocksRawStmtNoParse(stmt, …)` → `selectBlocksRawStmt` → `query(stmt)`.\n- `query()` (`kernel/sql/database.go`) calls `db.Query(stmt)` on the global `siyuan.db` handle.\n\n**Missing guards.** The comparable endpoints enforce restrictions this one omits:\n- `/api/query/sql` runs `CheckSingleStatement` (all modes) and `CheckReadonlyStatement` (readonly mode) and is route-gated `CheckAuth + CheckAdminRole + CheckReadonly`.\n- `fullTextSearchBlock` rejects the SQL search method for non-admins (`if method == 2 && !IsAdminRoleContext(c)`).\n\n`searchEmbedBlock` has none of these, no statement check, no read-only check, no admin gate.\n\n**Route/auth tier.** `router.go`: `Handle(\"POST\", \"/api/search/searchEmbedBlock\", model.CheckAuth, searchEmbedBlock)`, `CheckAuth` only. `CheckAuth` admits `RoleReader`, and the publish proxy forwards port-6808 traffic with a Reader JWT (anonymous account when publish auth is disabled). Anonymous/reader reachable.\n\n**Handle/stacking.** `query()` uses the global `siyuan.db` handle, the same read-write handle behind the accepted `searchDocs` finding. Driver is the vendored `88250/go-sqlite3` (mattn fork), whose connection `query` loops over `;`-separated statements, so stacked statements execute for their side effects. The DSN sets no `mode=ro` / `_query_only`, so the handle is read-write; `ATTACH` is available.\n\n**Post-hoc filter does not bound the statement.** `FilterEmbedBlocksByPublishAccess` runs on the returned slice *after* `query()` has executed. It filters rows; it cannot constrain what the statement did. Any write or `ATTACH` side effect has already occurred before the filter runs. It is not a security boundary for this sink.\n\n**Scope.** The main `blocks`/DB handle spans every opened cleartext notebook. Encrypted notebooks use separate per-box databases and are excluded.\n\n### Impact\n\nAn unauthenticated request (publish mode with auth disabled) or any publish `RoleReader` executes arbitrary SQL on the main read-write database. This permits cross-notebook read disclosure of document content, and via the read-write handle and statement stacking, modification of database content and `ATTACH`-reachable files. No admin role, CSRF token, or write permission through the normal API is required. Encrypted notebooks are not exposed. Code execution is not reachable in the default build (no `load_extension`).\n\n### PoC Steps\n\n1. Build the kernel image from pinned HEAD\n\n`docker build -f D:/bb/zitadel/chatto/siyuan/Dockerfile.poc -t siyuan-head D:/bb/zitadel/chatto/siyuan`\n\n2. Run fresh, workspace mounted to the host\n\n```\ndocker rm -f siyuan-poc 2>nul\ndocker run -d --name siyuan-poc -p 6806:6806 -p 6808:6808 -v D:/bb/siyuan:/siyuan/workspace siyuan-head serve --accessAuthCode=1234567 --port=6806\n```\n\nConfirm it booted (version string back, not Cobra help):\n\n```\ndocker logs siyuan-poc\ncurl -s http://127.0.0.1:6806/api/system/version\n```\n\n3. Grab the admin API token from the host file. Use that value wherever TOKEN appears below (yours was g4wj3r04ntobe9m4).\n\n4. Turn on the reader surface: publish on 6808, Basic Auth OFF\n\n`curl -s -X POST http://127.0.0.1:6806/api/setting/setPublish -H \"Content-Type: application/json\" -H \"Authorization: Token TOKEN\" -d \"{\\\"enable\\\":true,\\\"port\\\":6808,\\\"auth\\\":{\\\"enable\\\":false,\\\"accounts\\\":[]}}\"`\n\nMust return \"data\":{\"port\":6808,...} (non-zero port = bound OK). Port 6808, not 6806.\n\n5. THE PROOF: anonymous reader on 6808, no token (the differential)\n\nGuarded sibling rejects reader SQL:\n`curl -i -X POST http://127.0.0.1:6808/api/search/fullTextSearchBlock -H \"Content-Type: application/json\" -d \"{\\\"query\\\":\\\"SELECT * FROM blocks LIMIT 1\\\",\\\"method\\\":2}\"`\n\n→ -1 / \"SQL search requires administrator privileges\"\n\nsearchEmbedBlock accepts the same reader SQL (no guard):\n`curl -i -X POST http://127.0.0.1:6808/api/search/searchEmbedBlock -H \"Content-Type: application/json\" -d \"{\\\"embedBlockID\\\":\\\"\\\",\\\"stmt\\\":\\\"SELECT * FROM blocks LIMIT 1\\\",\\\"excludeIDs\\\":[]}\"`\n→ HTTP 200 / code:0 : arbitrary SQL executed at the anonymous reader tier. This pair is the finding.\n\n### Suggested fix\n\nApply the same controls the sibling SQL endpoints already use: route `searchEmbedBlock` through `CheckSingleStatement` and `CheckReadonlyStatement`, and gate the raw-SQL capability behind `CheckAdminRole` (as `/api/query/sql` and `fullTextSearchBlock`'s SQL method do). At minimum, the read paths should run on a `_query_only=1` handle so a reader-reachable statement cannot write or `ATTACH`.","state":0,"publishedAt":"2026-09-03T20:19:22+00:00","modifiedAt":"2026-09-10T15:25:43.162013+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260721002947-23a17d44b5f3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7","https://nvd.nist.gov/vuln/detail/CVE-2026-69084","https://github.com/siyuan-note/siyuan/commit/0015cbafbf685363b217bbc46283a3c0f51c79fa","https://github.com/siyuan-note/siyuan/commit/23a17d44b5f3da59c85e7fbee11236e6c12386b9","https://github.com/siyuan-note/siyuan","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock"],"sourceUrl":"https://github.com/advisories/GHSA-vh22-h7hf-www7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vh22-h7hf-www7","identifiers":["GHSA-vh22-h7hf-www7","CVE-2026-69084","GO-2026-6377"]},"retained":false,"historicalAffected":[]},{"revision":"49e0b7d0ea7246ab9308236e1337c44b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6377","aliases":["CVE-2026-69084","GHSA-vh22-h7hf-www7"],"title":"SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-09-10T14:48:42+00:00","modifiedAt":"2026-09-10T15:15:13.7521444+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260721002947-23a17d44b5f3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7","https://nvd.nist.gov/vuln/detail/CVE-2026-69084","https://github.com/siyuan-note/siyuan/commit/0015cbafbf685363b217bbc46283a3c0f51c79fa","https://github.com/siyuan-note/siyuan/commit/23a17d44b5f3da59c85e7fbee11236e6c12386b9","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6377","license":"OSV · upstream source license applies","key":"osv:GO-2026-6377","identifiers":["GO-2026-6377","CVE-2026-69084","GHSA-vh22-h7hf-www7"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T15:37:14.6597162+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T15:37:14.6597162+00:00","lastSuccessAt":"2026-10-26T15:37:14.8359072+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:14.835909+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-1bd091fc7fc10547d7167a606edbc49905944b97501a7ab971c3b58807479a43","complete":true,"records":414270,"lastAttemptAt":"2026-10-26T15:35:34.7444644+00:00","lastSuccessAt":"2026-10-26T15:35:34.5655912+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:35:34.7444644+00:00","snapshotPublishedAt":"2026-10-26T15:15:44+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T15:37:42.3202578+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":3564,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T15:37:14.6597162+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T15:37:14.6597162+00:00","lastSuccessAt":"2026-10-26T15:37:14.8367292+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:14.8367325+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f470a37230314a1cb4fdd0380273a29f","complete":true,"records":13416,"lastAttemptAt":"2026-10-26T15:37:40.3021752+00:00","lastSuccessAt":"2026-10-26T15:37:40.298+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:40.298+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T15:37:14.5249967+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:14.5249967+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T15:35:34.8406753+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:35:34.8406753+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-26T15:37:14.6306288+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:14.6306288+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e462c1c8904fe18fc1ab10d13d0abcd333d928efa63a77a5731657497361d59c","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T15:37:06.3736048+00:00","lastSuccessAt":"2026-10-26T15:37:05.2219961+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:06.3736048+00:00","snapshotPublishedAt":"2026-10-26T14:48:44+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}