SQL Injection Vulnerability in SiYuan from SiYuan Note

CVE-2026-101091

What is CVE-2026-101091?

SiYuan versions prior to 3.8.4 contain a security flaw that allows attackers to execute unauthorized SQL statements against the siyuan.db database. This vulnerability arises from improper validation of SQL queries within block query embed blocks. By crafting specific .sy documents, malicious actors can execute these queries automatically during background processes, such as indexing and rendering, exposing systems to potential data manipulation and compromise without needing any authentication.

References