H3-2026-1049¶
SiYuan Note searchEmbedBlock Arbitrary SQL Execution Vulnerability
| Category | VULNERABILITY |
| Base Score | 8.2 |
Description¶
B3log SiYuan Note contains a SQL injection vulnerability in the searchEmbedBlock API endpoint. The endpoint accepts an arbitrary SQL statement parameter from the request body and executes it directly against the internal blocks database without validating that it is a single read-only statement. This allows multi-statement SQL queries to be submitted via the stmt parameter in a crafted JSON request. The vulnerability is exploitable by remote attackers with network access to the SiYuan instance, as the X-Forwarded-For header can be used to bypass local-only access restrictions. The root cause is insufficient input validation on user-supplied SQL prior to execution against the application database.
Impact¶
Successful exploitation enables exfiltration of all stored notes and documents from the SiYuan internal database. Hidden and password-protected content intended to be inaccessible becomes fully readable. Organizations using SiYuan for sensitive documentation face complete loss of data confidentiality. Knowledge workers, researchers, and small teams are the most likely affected user base.