Threats Tagged 'ghsa-hvf4-6hmp-9mpm'

SiYuan note-taking software versions before 3.8.4 contain a high-severity SQL injection vulnerability in the graph query endpoint. The vulnerability arises because the dailyNoteSavePath parameter is concatenated into an SQL query without proper escaping. This allows unauthenticated attackers on published sites with authentication disabled to perform SQL injection via UNION SELECT, potentially extracting arbitrary database rows from all notebooks.