Technical impact
The vulnerability is a classic SQL injection (CWE-89) that allows an attacker to inject arbitrary SQL statements into the searchEmbedBlock endpoint. Because the endpoint forwards the statement verbatim to the database driver without tighter execution control, an attacker can read all cleartext notebook data and modify any record, leading to data disclosure and tampering across the application.
Affected Systems
The flaw affects the Siyuan note‑taking application from the vendor siyuan-note, specifically all releases up to and including version 3.7.2. The /api/search/searchEmbedBlock API is exposed whenever authentication is enabled for the role Reader or when anonymous publishing is disabled.
Risk and Exploitability
With a CVSS score of 9.9 the vulnerability is considered critical. Although the EPSS score is not provided, the absence of attack restrictions means that any user with a publish RoleReader token or any anonymous visitor can exploit it. The issue is not listed in the CISA KEV catalog, but the ability to execute stacked statements gives an adversary direct and straightforward access to sensitive data.
Github GHSA