High severity8.0NVD Advisory· Published Aug 12, 2026· Updated Aug 26, 2026
CVE-2026-72807
CVE-2026-72807
Description
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or packages with crafted template columns that execute arbitrary SQL on a victim's kernel when the package is imported and rendered, enabling read and write access across notebooks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/siyuan-note/siyuan/kernelGo | < 0.0.0-20260723035036-0a176345e02a | 0.0.0-20260723035036-0a176345e02a |
Affected products
2- Range: <3.7.4
- ghsa-coordsRange: < 0.0.0-20260723035036-0a176345e02a
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-x67c-8pwr-m8g3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-72807ghsaADVISORY
- github.com/siyuan-note/siyuan/commit/0a176345e02a0d19bdc7762e50e0b92002087d20ghsaWEB
- github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3nvdWEB
- www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-templatenvdWEB
News mentions
1- Siyuan Note: 22 Vulnerabilities Disclosed Together, Patch Released in v3.7.4Vypr Intelligence · Aug 12, 2026