CVE-2026-72807

SiYuan's attribute-view (AV) template columns are live-evaluated on every render and expose a queryBlocks template function that passes its argument to the SQLite database as a raw statement using string substitution instead of parameter binding, so attacker-controlled text becomes arbitrary SQL. The flaw is second-order rather than directly injectable: an attacker distributes a SiYuan document or AV package whose template column embeds a queryBlocks call, and when a victim imports the package and the attribute view is rendered, the embedded SQL executes on the victim's kernel. Because the underlying driver supports statement stacking, the attacker's SQL is not limited to reading data and can also write, yielding high confidentiality and integrity impact (CVSS 3.1 score 8.0) with user interaction required. Any SiYuan user who imports third-party documents or AV packages is affected; direct injection is gated behind admin-level AV changes, and the broader SSTI surface (env, expandenv, getHostByName) is already hardened, leaving queryBlocks as the remaining live-evaluated sink. No public proof of concept, KEV listing, or in-the-wild exploitation is known, and EPSS currently estimates a 0.2% probability of exploitation within 30 days.

What to do: No fixed version is identified in the available data, so check SiYuan's release notes and upgrade as soon as the maintainers publish a patched build. Until then, do not import attribute-view packages or documents from untrusted sources, and inspect imported AV template columns for embedded queryBlocks calls before rendering them. Monitor the notes database for unexpected changes, since the flaw permits writes via statement stacking and not just reads.