{"id":"EUVD-2026-42742","enisaUuid":"319c2184-7730-3c89-a981-7261a3df31ae","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This issue is fixed in versions 3.7.1.","datePublished":"Jul 9, 2026, 10:15:48 PM","dateUpdated":"Jul 10, 2026, 1:33:27 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88\nhttps://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d\nhttps://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e\nhttps://github.com/siyuan-note/siyuan/releases/tag/v3.7.1\n","aliases":"CVE-2026-59834\nGHSA-h89q-4j2h-7h88\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"436bc6c9-f852-348a-a071-3b503313067c","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.1"}],"enisaIdVendor":[{"id":"82fdf2f2-1546-34df-8fca-7281cd8a38e3","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"7a49668f-8e46-3632-89c0-98a54a40bf46","vulnerability":{"id":"CVE-2026-59834","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This issue is fixed in versions 3.7.1.","datePublished":"Jul 9, 2026, 10:15:48 PM","dateUpdated":"Jul 10, 2026, 1:33:27 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88\nhttps://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d\nhttps://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e\nhttps://github.com/siyuan-note/siyuan/releases/tag/v3.7.1\n","enisa_id":"EUVD-2026-42742\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Nov 1, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"c686d99b-ea4d-36e2-a2bb-6e76cecfffff","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.1"}],"vulnerabilityVendor":[{"id":"87cbfe82-69ee-3174-94a3-0eb3b9c2cfd7","vendor":{"name":"siyuan-note"}}]}},{"id":"c20e8934-431c-3605-aff0-4e3d09db92ef","vulnerability":{"id":"GHSA-h89q-4j2h-7h88","description":"SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content","datePublished":"Sep 2, 2026, 2:16:08 PM","dateUpdated":"Sep 2, 2026, 2:16:08 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59834\nhttps://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d\nhttps://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e\nhttps://github.com/siyuan-note/siyuan\nhttps://github.com/siyuan-note/siyuan/releases/tag/v3.7.1\n","enisa_id":"EUVD-2026-42742\n","aliases":"GHSA-h89q-4j2h-7h88\nCVE-2026-59834\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}