CVE-2026-101091CWE-89sql-injection

CVE-2026-101091

High · published September 29, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-29T02:17Z
References (4)
https://github.com/siyuan-note/siyuan/commit/e8ace0c89182c7ee1a1298ff2a849bb6a83dfdec · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67p9-hm94-xwf3 · [email protected]https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-block-query-embed · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67p9-hm94-xwf3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 22:00Z
    SiYuan before v3.8.4 SQL Injection via Block Query Embed
    cvelistv5