CVE-2026-93591 — SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go
SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without es…
Published: 2026-09-18 · CVSS: 7.2 · CVSS 4.0
SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7