Kernel: Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title)…

SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go). The query concatenates stored block metadata (title, name, alias, anchor text) and client-supplied keywords into a SQL MATCH/search statement, escaping only double quotes but not single quotes. This improper sanitization allows single quotes in client input (first-order injection) or stored document metadata (second-order injection) to break out of string literals. Because the query runs on the main read-write siyuan.db handle via a statement-stacking-capable driver, an attacker can execute arbitrary SQL commands, enabling cross-notebook read and write access. The vulnerability is fixed in version v3.7.4.

An unauthenticated attacker or a user with RoleReader privileges on the publish surface can exploit this vulnerability to execute arbitrary SQL commands on the main database. This can lead to unauthorized reading and modification of data across notebooks, compromising confidentiality and integrity. The vulnerability has a CVSS 3.1 score of 10.0 (critical), indicating high impact with network attack vector, no privileges required, no user interaction, and scope change.

Upgrade to SiYuan version v3.7.4 or later, where this SQL injection vulnerability has been fixed. No other mitigations are indicated. Patch status is confirmed fixed in v3.7.4.