A critical SQL injection vulnerability in SiYuan allows unauthenticated remote attackers to read and modify sensitive database content via the searchDocs API endpoint.

The /api/filetree/searchDocs endpoint fails to properly sanitize the keyword parameter, allowing for SQL injection. Because the application uses a SQLite driver that supports stacked queries, an attacker can execute arbitrary SQL commands to manipulate the database.

This vulnerability allows for the theft of all cleartext notebook data and unauthorized modification of database records. Given the potential for complete data loss and integrity compromise, this vulnerability is rated as a 10.0 critical risk.

Immediate Action: Update SiYuan to version 3.7.3 or later to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review application access logs for unusual search query patterns or requests containing SQL syntax characters like semicolons.

Compensating Controls: Enable authentication for all publication modes and implement a Web Application Firewall (WAF) to filter malicious input from API requests.

Public Exploit Available: Unknown

This is an extremely severe vulnerability that exposes the entirety of the database to unauthenticated attackers. Organizations running SiYuan must prioritize updating to version 3.7.3 immediately and ensure that publish mode settings are configured securely to minimize exposure.