The vulnerability is an SQL Injection (CWE‑89) in the fullTextSearchAssetContent endpoint of SiYuan. Unauthenticated users can supply malicious parameters, including REGEXP clauses, that are incorporated into raw SQL queries without proper escaping. This allows an attacker to execute arbitrary SQL commands against the read‑write asset‑content database, enabling them to read, modify, or delete data across any notebook.

SiYuan Note versions prior to 3.7.3 are affected. All deployments using these versions expose the vulnerable fullTextSearchAssetContent endpoint and therefore are susceptible to exploitation.

The vulnerability carries a CVSS score of 9.9, indicating critical severity. EPSS data is not available, but the lack of authentication prerequisites and the broad data impact make it highly attractive for adversaries. The vulnerability is not yet listed in CISA's KEV catalog, but its exploitation potential warrants immediate attention. Attackers can reach the endpoint over the network without credentials, making the attack vector straightforward and low‑effort.