CVE-2026-101091
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.32% probability · 24th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Source
- disclosure@vulncheck.com
EPSS moved from 0.3% on 29 September 2026 to 0.3% on 26 October 2026.
References
- https://github.com/siyuan-note/siyuan/commit/e8ace0c89182c7ee1a1298ff2a849bb6a83dfdec
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67p9-hm94-xwf3
- https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-block-query-embed
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67p9-hm94-xwf3
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.