{"cve":"CVE-2026-72807","nvd":{"published":"2026-08-12T20:17:52.837","modified":"2026-10-24T15:10:00.190","status":"Deferred","description":"SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or packages with crafted template columns that execute arbitrary SQL on a victim's kernel when the package is imported and rendered, enabling read and write access across notebooks.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":8.8},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","score":8.0},"cwes":["CWE-89"],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-template"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:35.584907681+00:00"},"epss":{"cve":"CVE-2026-72807","score":0.00333,"percentile":0.26286,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-x67c-8pwr-m8g3","url":"https://osv.dev/vulnerability/GHSA-x67c-8pwr-m8g3","summary":"SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel","modified":"2026-09-10T15:25:42.037056794Z","packages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel","ranges":["<0.0.0-20260723035036-0a176345e02a"],"fixed":["0.0.0-20260723035036-0a176345e02a"]}]},{"id":"GO-2026-6410","url":"https://osv.dev/vulnerability/GO-2026-6410","summary":"SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel in github.com/siyuan-note/siyuan/kernel","modified":"2026-09-10T15:15:14.108601340Z","packages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel","ranges":["<0.0.0-20260723035036-0a176345e02a"],"fixed":["0.0.0-20260723035036-0a176345e02a"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}