CVE-2026-69084

The /api/search/searchEmbedBlock endpoint in SiYuan accepts a client-supplied SQL statement and executes it verbatim on the main read-write siyuan.db SQLite handle, with none of the single-statement, read-only, or admin restrictions enforced by sibling endpoints like /api/query/sql. Because the route is gated only by CheckAuth, an unauthenticated visitor (when publish authentication, Publish.Auth.Enable, is disabled) or anyone holding a Reader token can reach it through publish mode on port 6808 and run arbitrary SQL, including stacked statements and ATTACH, reading and writing across all cleartext notebooks. An attacker therefore gains read and write access to the entire note database (disclosure and tampering of note content), consistent with the CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Affected users are SiYuan deployments that expose the publish-mode API to untrusted networks or clients; the advisory data does not specify affected or fixed version ranges. No public proof-of-concept or in-the-wild exploitation is currently known; the flaw is not in CISA KEV and EPSS estimates a 1.1% probability of exploitation within 30 days (64th percentile).

What to do: Until a patched release is identified (no fixed version is given in the advisory), reduce exposure by enabling publish authentication (set Publish.Auth.Enable so anonymous access is disallowed), firewalling or reverse-proxy-restricting port 6808 and the /api/search/searchEmbedBlock route, and reviewing notebook data for unexpected modifications. Monitor the siyuan-note project for an update addressing CVE-2026-69084 and upgrade promptly once a fixed version is published.