SQL injection in SiYuan backlink/mention search query (CVE-2026-72811)

The backlink/mention search query in SiYuan (kernel/model/backlink.go) concatenates stored block metadata and client-supplied keywords into a SQL MATCH statement, escaping only double quotes and leaving single quotes unescaped. This enables both first-order injection via a client-supplied keyword (reachable by anonymous or RoleReader users on the publish surface) and second-order injection via stored document metadata (title, name, alias, anchor text). Because the statement executes on the main read-write siyuan.db handle through a statement-stacking-capable driver, exploitation can yield arbitrary SQL execution with cross-notebook read and write access. Affected versions: - <=v3.7.2 We recommend updating to: v3.7.4. CVSS 9.9 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc Details: https://vuln.today/cve/CVE-2026-72811