Arbitrary SQL execution in SiYuan via searchEmbedBlock endpoint (CVE-2026-69084)

The `/api/search/searchEmbedBlock` endpoint in SiYuan passes a client-supplied SQL statement verbatim to the main read-write `siyuan.db` handle with no validation, single-statement guard, read-only restriction, or admin role requirement. The endpoint is gated only by `CheckAuth`, making it reachable by the publish `RoleReader` token and by anonymous users when `Publish.Auth.Enable` is false. Because the underlying driver executes stacked statements on a read-write handle, an attacker can read and write content across all cleartext notebooks without administrative privileges. Affected versions: - <=v3.7.2 We recommend updating to: v3.7.3. CVSS 9.9 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7 Details: https://vuln.today/cve/CVE-2026-69084