CVE-2026-69084 is a critical SQL injection vulnerability affecting SiYuan note-taking software versions <=3.7.2. The /api/search/searchEmbedBlock endpoint passes client-supplied SQL commands verbatim to the main read-write database handle (siyuan.db) without enforcing single-statement, read-only, or administrative restrictions. Access to this endpoint requires only CheckAuth, which can be bypassed by users with the publish RoleReader token or by anonymous users if publish authentication is disabled. The underlying database driver supports stacked SQL statements, enabling attackers to execute multiple commands, thereby reading and modifying content across all open cleartext notebooks. Encrypted per-box notebooks are not affected. The vulnerability is resolved in version 3.7.3.

An attacker can exploit this vulnerability to execute arbitrary SQL commands on the main database, leading to unauthorized reading and modification of content in all open cleartext notebooks. This compromises data confidentiality and integrity. The vulnerability is exploitable remotely without authentication under certain configurations, making it highly critical.

A fix is available in SiYuan version 3.7.3. Users should upgrade to version 3.7.3 or later to remediate this vulnerability. Until upgraded, restrict access to the /api/search/searchEmbedBlock endpoint and ensure publish authentication is enabled to prevent anonymous exploitation.