A critical SQL injection vulnerability in SiYuan versions prior to 3.8.3 allows unauthorized actors to execute arbitrary database queries, posing a severe risk of private data exfiltration.

The vulnerability resides in the graph.go query2Stmt function, where tag values are improperly concatenated into SQL string literals. This allows a publish-mode reader or anonymous visitor to inject malicious SQL commands via inline HTML span tags in the getGraph endpoint.

The ability to perform unauthorized SQL queries against the underlying database presents a high risk of sensitive information disclosure, including the exfiltration of private data across notebooks. Given the CVSS score of 7.6, this vulnerability is classified as high severity, as it facilitates direct access to the backend data layer and could lead to significant reputational damage or loss of intellectual property.

Immediate Action: Update the SiYuan application to version 3.8.3 or later immediately, as this version contains the necessary fix to sanitize input and prevent SQL injection.

Proactive Monitoring: Review database access logs for unusual query patterns or syntax errors, particularly those originating from the getGraph endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting HTML attributes or span tags.

Public Exploit Available: Unknown.

Due to the high severity of this SQL injection vulnerability and the existence of proof-of-concept material, organizations running affected versions of SiYuan must prioritize patching. Failure to update to version 3.8.3 leaves the system exposed to potential data theft by anonymous actors. Security teams should ensure the update is applied across all instances and verify that database query logging is enabled to detect any signs of attempted exploitation.