The vulnerability exists in SiYuan's backlink/mention search feature (kernel/model/backlink.go) where it naively concatenates user‑supplied search keywords and stored document metadata into a SQL MATCH statement, escaping only double quotes but not single quotes. This allows an attacker to inject a single quote to break out of the string literal, leading to arbitrary SQL execution against the main read‑write siyuan.db handle.

The affected product is SiYuan, a note‑taking application from Siyuan Note (siyuan‑note). All versions up to and including 3.7.2 are impacted; the fix was released in v3.7.4.

The CVSS score of 9.9 reflects the full impact of uncontrolled SQL execution. Because an anonymous or RoleReader user can trigger the vulnerable search on the public publish surface, the attacker does not need privileged credentials, and the driver’s support for statement stacking amplifies the damage by allowing read and write across all notebooks. Intrusion is highly likely, and the vulnerability is not yet listed in KEV, but the absence of an EPSS score does not diminish the high inherent risk.