CVE-2026-69083

Critical

Description

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

SeverityCritical

CVSS10.0

Exploit probability—

ProductGithub.com/siyuan-note/siyuan/kernel

PublishedAug 3, 2026

First seenAug 3, 2026

Weakness typeCWE-89SQL injection

How to fix

Update

github.com/siyuan-note/siyuan/kernel0.0.0-20260721004815-cf42dd5680c8 or later

Vendor advisories

github.com/siyuan-note/siyuan/security/advisories/GHSA-fph3-ghq9-vw66

Affected products

Product	Affected versions	Fixed in
github.com/siyuan-note/siyuan/kernelGo	v < 0.0.0-20260721004815-cf42dd5680c8	0.0.0-20260721004815-cf42dd5680c8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.