A critical SQL injection vulnerability in SiYuan allows unauthenticated attackers to execute arbitrary SQL commands, resulting in unauthorized read and write access across the database.

The application fails to properly neutralize single quotes within the backlink/mention search functionality, allowing attackers to break out of SQL string literals. Because the database driver supports statement stacking, this permits attackers to execute arbitrary SQL commands with the privileges of the application.

This vulnerability allows an attacker to manipulate the underlying database, leading to potential data exposure, data modification, or deletion of sensitive information across all notebooks. Given the CVSS score of 10.0, the impact on confidentiality, integrity, and availability is considered total, which could result in significant operational disruption and loss of proprietary data.

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later immediately.

Proactive Monitoring: Review database access logs for unexpected SQL queries or signs of unauthorized data modification.

Compensating Controls: Implement strict input validation or use a WAF to filter out SQL injection patterns, such as single quotes and common SQL keywords, from search queries.

Public Exploit Available: Unknown

Organizations must prioritize updating to version 3.7.4 to remediate this critical flaw. Failure to patch leaves the system open to full database compromise, and immediate action is required to ensure the integrity of stored data.