Duplicate Advisory: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

SiYuan before version 3.7.4 has a second-order SQL injection vulnerability (CWE-89) in attribute-view template columns that expose the queryBlocks function. This function executes raw SQL via string substitution rather than using parameterized queries, allowing attackers to craft malicious documents or packages that execute arbitrary SQL on the victim's kernel upon import and rendering. This results in potential read and write access across notebooks within the application.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the victim's kernel, leading to read and write access across notebooks. This compromises data confidentiality and integrity within the affected SiYuan environment. The vulnerability has a high severity score (CVSS 8.0) with network attack vector, high impact on confidentiality and integrity, and requires user interaction with high attack complexity.

A fix is available in SiYuan version 3.7.4 and later. Users should upgrade to version 3.7.4 or newer to remediate this vulnerability. Since no official patch links are provided in the advisory, verify the upgrade availability and details from the official SiYuan project sources or vendor advisory before applying.