Kernel: Duplicate Advisory: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which accepts a client-supplied SQL statement and executes it verbatim on the main read-write siyuan.db handle. There are no single-statement, read-only, or admin restrictions applied. The endpoint is protected only by CheckAuth, making it accessible to the publish RoleReader token and anonymous users if publish authentication is disabled. Due to the underlying database driver's support for stacked statements, an attacker can perform arbitrary SQL execution, enabling cross-notebook read and write access to all opened cleartext notebooks (excluding encrypted per-box notebooks). This vulnerability is identified as CWE-89 (SQL Injection) and has a CVSS 3.1 base score of 10.0 (critical). It was fixed in version v3.7.3.

An unauthenticated attacker or a user with limited publish RoleReader privileges can execute arbitrary SQL commands on the main read-write database. This allows reading and modifying data across all opened cleartext notebooks, potentially leading to full compromise of notebook contents. Encrypted per-box notebooks are not affected. The vulnerability has a critical severity rating with a CVSS score of 10.0, indicating a high impact on confidentiality and integrity.

Upgrade SiYuan to version v3.7.3 or later, where this vulnerability is fixed. Until the upgrade, restrict access to the /api/search/searchEmbedBlock endpoint by enforcing strict authentication and disabling publish mode if possible. Review and monitor access controls related to the publish RoleReader token. Patch status is confirmed fixed in v3.7.3.