GHSA-pqpf-6vqv-6w92

Source

https://github.com/advisories/GHSA-pqpf-6vqv-6w92

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-pqpf-6vqv-6w92/GHSA-pqpf-6vqv-6w92.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pqpf-6vqv-6w92

Withdrawn

2026-09-03T21:00:29Z

Published

2026-08-03T15:32:48Z

Modified

2026-09-03T21:15:04Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
9.9 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fph3-ghq9-vw66. This link is maintained to preserve external references.

Original Description

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

Database specific

{
    "cwe_ids":  [
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-03T21:00:29Z",
    "nvd_published_at":  "2026-08-03T14:16:28Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Go / github.com/siyuan-note/siyuan

Package

Name: github.com/siyuan-note/siyuan; View open source insights on deps.dev
Purl: pkg:golang/github.com/siyuan-note/siyuan

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

last_known_affected_version_range

"< 3.7.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-pqpf-6vqv-6w92/GHSA-pqpf-6vqv-6w92.json"