CVE-2026-72811

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description A SQL injection issue exists in the backlink/mention search query within kernel/model/backlink.go. The application concatenates stored block metadata (title, name, alias, anchor text) and a client-supplied keyword into a SQL MATCH/search statement, escaping only double-quote characters and failing to escape single quotes. A single quote in the client keyword or stored document metadata allows an attacker to break out of the string literal. Since the query uses a statement-stacking-capable driver on the main read-write siyuan.db handle, an attacker can execute arbitrary SQL, enabling unauthorized read and write access across notebooks. This is reachable by anonymous users or those with RoleReader permissions on the publish surface.

Recommendations Update to version 3.7.4.