CVE-2026-72807

Severity CVSS v4.0:

HIGH

Type:

CWE-89 SQL Injection

Publication date:

12/08/2026

Last modified:

26/08/2026

Description

SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or packages with crafted template columns that execute arbitrary SQL on a victim&#39;s kernel when the package is imported and rendered, enabling read and write access across notebooks.

Impact

Vector 4.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS v4.0 Severity and Metrics:

Base Score: 8.80 HIGH
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Attack Requirements (AT): Present
Privileges Required (PR): None
User Interaction (UI): Passsive
Confidentiality (VC): High
Integrity (VI): High
Availability (VA): None
Confidentiality (SC): High
Integrity (SI): High
Availability (SA): None

Base Score 4.0

8.80

Severity 4.0

HIGH

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 8.00 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Changed
Confidentiality (C): High
Integrity (I): High
Availability (A): None

Base Score 3.x

8.00

Severity 3.x

HIGH

CVE-2026-72807

Description

Impact

References to Advisories, Solutions, and Tools