CVE-2026-69084

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3

Description The '/api/search/searchEmbedBlock' endpoint passes a client-supplied SQL statement directly to the main read-write siyuan.db handle without restrictions on single statements, read-only access, or administrative privileges. The endpoint is protected only by CheckAuth, allowing access via the publish RoleReader token or by anonymous users if publish authentication is disabled. Since the driver supports stacked statements (the ability to execute multiple SQL commands in a single call), an attacker can read and modify content across all opened cleartext notebooks, although encrypted per-box notebooks are not affected.

Recommendations Update to version 3.7.3.