CVE-2026-54068

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0

Description The /api/icon/getDynamicIcon endpoint is excluded from authentication. When this endpoint is called with type=8 and a valid block id parameter, it invokes the RenderDynamicIconContentTemplate function, which executes a Go template containing the querySQL() and queryBlocks() functions. These functions allow the execution of arbitrary SELECT statements against the SQLite database. An unauthenticated network-adjacent attacker with knowledge of a valid block ID can exfiltrate user note content, tags, asset references, and block attributes.

Recommendations Update SiYuan to version 3.7.0.