CVE-2026-93591

7.2 highEPSS 0.3%

High (7.2). EPSS 0.3% chance of exploitation in the next 30 days.

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

Severity

CVSS 4.0

7.2 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

7.6 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-09-18
Modified: 2026-09-18
Record from: the NVD, synced 2026-10-19

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954
https://www.vulncheck.com/advisories/siyuan-before-3.8.3-sql-injection-via-unescaped-tag-in-graph-go
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954

Check your stack JSON