SiYuan versions before 3.7.4 contain a second‑order SQL injection flaw in the attribute‑view template columns that expose the queryBlocks function. The function uses raw string substitution instead of parameterized queries, allowing attackers to embed crafted template columns that execute arbitrary SQL against the database when a package is imported and rendered. The resulting vulnerability can be leveraged to read or write data across notebooks, effectively giving an attacker read/write access to all user data. This is a high‑severity flaw classified under CWE-89 with a CVSS score of 8.8.

The affected product is Siyuan Note, specifically all releases prior to version 3.7.4. No specific sub‑versions beyond the overall cut‑off are enumerated in the advisory, but any installation running an earlier build is at risk.

The CVSS score indicates that successful exploitation would have major impact. The EPSS score is not available, so no direct exploitation likelihood is known; the vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to deliver a malicious SiYuan document or package that a victim opens or imports. Therefore the most likely exploitation scenario involves a local user interface or a supply‑chain style delivery where an attacker supplies a forged package containing a crafted queryBlocks template column. Once imported, arbitrary SQL would run with the privileges of the running SiYuan process.