GHSA-p2x7-4c4p-8wh6

Source

https://github.com/advisories/GHSA-p2x7-4c4p-8wh6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p2x7-4c4p-8wh6/GHSA-p2x7-4c4p-8wh6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p2x7-4c4p-8wh6

Withdrawn

2026-09-03T20:19:13Z

Published

2026-08-03T15:32:48Z

Modified

2026-09-03T20:30:04Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
9.9 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vh22-h7hf-www7. This link is maintained to preserve external references.

Original Description

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T20:19:13Z",
    "nvd_published_at": "2026-08-03T14:16:28Z",
    "severity": "CRITICAL"
}

References

Affected packages

Go / github.com/siyuan-note/siyuan/kernel

Package

Name: github.com/siyuan-note/siyuan/kernel; View open source insights on deps.dev
Purl: pkg:golang/github.com/siyuan-note/siyuan/kernel

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

last_known_affected_version_range

"< 3.7.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p2x7-4c4p-8wh6/GHSA-p2x7-4c4p-8wh6.json"