High severity · published Sep 28, 2026
CVE-2026-101091
SiYuan before v3.8.4 SQL Injection via Block Query Embed
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101091
vendor-advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67p9-hm94-xwf3
patch
https://github.com/siyuan-note/siyuan/commit/e8ace0c89182c7ee1a1298ff2a849bb6a83dfdec
third-party-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-block-query-embed
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP