CVE-2026-93591

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.3

Description An SQL injection issue exists in the query2Stmt() function within graph.go. The flaw occurs because tag values are concatenated directly into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can exploit this by using inline HTML span tags via the 'getGraph' endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

Recommendations Update to version 3.8.3 or later.