CVE-2026-93591

HIGHCVSS 7.6

Description

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

Timeline

Published:September 18th, 2026 2:19 PM

Last modified:September 18th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 7.6 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-89

References & Reports

Advisories, patches, and third-party reports

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954
https://www.vulncheck.com/advisories/siyuan-before-3.8.3-sql-injection-via-unescaped-tag-in-graph-go
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954

Source: NIST NVD · Data may lag official sources by up to one minute