CVE-2026-100644

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2026-09-26

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc
• https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-dailynotesavepath
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc

Check your stackJSON