CVE-2026-72807 siyuan-note CVE debrief

Who should care

SiYuan users and administrators should be aware of this vulnerability and take steps to mitigate it. This includes applying patches or updates to SiYuan to version v3.7.4 or later, restricting access to untrusted SiYuan documents or packages, and monitoring SiYuan installations for suspicious activity.

Technical summary

CVE-2026-72807 is a second-order SQL injection vulnerability in SiYuan versions before v3.7.4. The vulnerability is located in attribute-view template columns, which expose the queryBlocks function. This function executes raw SQL using string substitution instead of parameterized queries. Attackers can exploit this by distributing malicious SiYuan documents or packages with crafted template columns. When these packages are imported and rendered, the crafted columns can execute arbitrary SQL on a victim's kernel, potentially enabling read and write access across notebooks.

Defensive priority

SiYuan users should prioritize patching to prevent potential SQL injection attacks.

Recommended defensive actions

• Apply patches or updates to SiYuan to version v3.7.4 or later
• Restrict access to untrusted SiYuan documents or packages
• Monitor SiYuan installations for suspicious activity
• Implement additional security controls to detect and prevent SQL injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-72807 record indicates a second-order SQL injection vulnerability in SiYuan versions before v3.7.4. The vulnerability is located in attribute-view template columns, which expose the queryBlocks function. This function executes raw SQL using string substitution instead of parameterized queries. Attackers can exploit this by distributing malicious SiYuan documents or packages with crafted template columns. When these packages are imported and rendered, the crafted columns can execute arbitrary SQL on a victim's kernel, potentially enabling read and write access across notebooks. However, detailed information about the vulnerability, such as proof of exploitability or specific attack scenarios, is limited in the provided source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.