CVE-2026-93591

high

Description

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

References

https://www.vulncheck.com/advisories/siyuan-before-3.8.3-sql-injection-via-unescaped-tag-in-graph-go

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954

Details

Source: Mitre, NVD

Published: 2026-09-18

Updated: 2026-09-18

Risk Information

CVSS v2

Base Score: 8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:P

Severity: High

CVSS v3

Base Score: 7.6

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Severity: High

CVSS v4

Base Score: 7.2

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00288