High severity · published Sep 18, 2026
CVE-2026-93591
SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go
7.6
CVSS
0.3%
EPSS
No
On KEV
Description
SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.8.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93591
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93591
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-3.8.3-sql-injection-via-unescaped-tag-in-graph-go
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP