SQL Injection Vulnerability in SiYuan by SiYuan Note

CVE-2026-93591

What is CVE-2026-93591?

SiYuan versions prior to 3.8.3 are susceptible to an SQL injection vulnerability found in the graph.go query2Stmt function. This vulnerability occurs due to the improper concatenation of tag values into SQL string literals, specifically failing to escape single quotes. An attacker, such as a publish-mode reader or an anonymous visitor, can exploit this flaw by injecting SQL commands through inline HTML span tags in the getGraph endpoint. This can result in the execution of arbitrary SQL queries against the read-write database, potentially leading to the exfiltration of sensitive data stored within notebooks.

References