CVE-2026-93591

7.6 HIGHpublic exploit available

Published 2026-09-18 · Updated 2026-09-18

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Weaknesses

CWE-89

Public exploit & PoC references

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954

All references

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954
https://www.vulncheck.com/advisories/siyuan-before-3.8.3-sql-injection-via-unescaped-tag-in-graph-go
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rwv-4j4c-f954

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2015-20122
HIGHCVE-2019-25776PoC
HIGHCVE-2021-48008
HIGHCVE-2022-4997
CRITICALCVE-2023-54399
CRITICALCVE-2023-54400PoC
CRITICALCVE-2025-63564
MEDIUMCVE-2026-100312PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.