SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns. This flaw allows execution of arbitrary SQL commands on the victim's kernel when a malicious package with crafted template columns is imported and rendered. The vulnerability arises because the queryBlocks function executes raw SQL using string substitution instead of parameterized queries. This enables attackers to gain read and write access across notebooks.