Overview
A perfect-score SQL injection vulnerability has been identified in SiYuan, a popular self-hosted note-taking and knowledge management application. Tracked as CVE-2026-72811 with a CVSS 10.0 (Critical) rating, the flaw resides in the backlink and mention search query handling within the Go backend (kernel/model/backlink.go). An attacker who can control stored block metadata — titles, names, aliases, or anchor text — can inject arbitrary SQL that executes against the application's SQLite database.
Vulnerability Details
SiYuan's backlink/mention feature searches across block metadata to surface related notes. The vulnerability occurs because:
- User-controlled metadata (block title, name, alias, anchor text) is stored in the database and later retrieved to build SQL queries.
- The code in
kernel/model/backlink.goconcatenates this stored metadata and a client-suppliedkeyworddirectly into a SQLMATCH/search statement. - While the code escapes double-quote characters, it does not escape single quotes or other SQL metacharacters, leaving the statement vulnerable to injection through stored content.
Because the injected SQL originates from stored block data rather than only from the immediate client request, this is a stored/second-order SQL injection — any user who can create or edit blocks (including the local user, shared workspace participants, or API consumers) can plant malicious metadata that triggers when another user performs a backlink search.
Impact
| Attribute | Value |
|---|---|
| CVSS Score | 10.0 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None (varies by deployment) |
| User Interaction | None |
| Impact | Full database read/write; potential host-level access via SQLite extensions |
Given SiYuan's use of SQLite, successful injection can enumerate all notebook content, exfiltrate notes, modify or delete data, and — depending on SQLite configuration — potentially load extensions for OS-level command execution.
Affected Versions
- SiYuan ≤ v3.7.2 — all versions at or below this release are vulnerable.
Patch
Users should upgrade to the version following v3.7.2 once it is available. Monitor the SiYuan releases page for a patched build that uses parameterized queries or properly sanitizes all metadata fields before inclusion in SQL statements.
Remediation
- Update SiYuan to the patched release as soon as it is published.
- Restrict access: If SiYuan is network-accessible (not just localhost), place it behind authentication or a firewall. Exposing SiYuan directly to untrusted networks significantly amplifies the blast radius.
- Audit block content: Review recently created blocks for suspicious SQL fragments (single quotes, SQL keywords like
UNION,SELECT,DROP) in titles, names, or aliases. - Isolate the deployment: Run SiYuan in a container or VM with minimal filesystem access to limit the impact of any SQLite extension abuse.
Temporary Workaround
If you cannot update immediately:
- Disable network access to SiYuan's API port (default: 6806) from untrusted hosts using a firewall or reverse-proxy allowlist.
- Avoid shared workspaces with untrusted parties until the patch is applied.
Why CVSS 10.0?
A perfect CVSS score requires no network barriers, no privilege requirements, and complete impact across confidentiality, integrity, and availability. CVE-2026-72811 meets these thresholds: the stored injection vector means no special credentials are needed beyond the ability to view content, the database contains all user notes (confidentiality), writes can corrupt or delete data (integrity and availability), and in some configurations SQLite extensions could escalate to the host (system-level impact).