SiYuan CVE-2026-101091

Requires that a victim's SiYuan instance (before v3.8.4) process an attacker-supplied .sy document containing a block-query embed block with a non-read-only SQL statement; execution is triggered automatically by background indexing, rendering, or export - no login or explicit query action is needed once the malicious document is present. Limiting factors: the attacker must first get the hostile .sy file onto the victim's instance (via document sharing, sync, or import), so this is passive user interaction (UI:P) rather than direct remote invocation; the vulnerable path relies on the pre-patch substring 'select' check and the vitess parser's fall-through-to-execute behavior, both fixed in v3.8.4. The malicious SQL runs against the local SQLite siyuan.db, enabling data exfiltration (e.g. VACUUM INTO to a chosen file path) and data tampering (DELETE/UPDATE/ATTACH/PRAGMA writable_schema).

This is a moderate-priority issue whose real-world risk is constrained by the delivery model rather than by exploit difficulty. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N, 7.1) correctly captures the key nuance: exploitation is network-reachable and needs no authentication, but it DOES require passive user interaction (UI:P) - a victim must open, import, or sync an attacker-crafted .sy document, after which malicious SQL fires automatically during background indexing, rendering, or export. This is effectively a client-side/passive-content attack, not a directly server-facing remote exploit, so PR:N should not be read as 'trivially internet-exploitable.' No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, and no public exploit was supplied (the source-code evidence is the vendor's own fix and regression tests, NOT a weaponized POC). The flaw is genuine and well-substantiated - reported by VulnCheck with a vendor advisory (GHSA-67p9-hm94-xwf3), a fix commit, and an authoritative root-cause: the pre-patch code gated 'read-only' purely on whether the statement contained the substring 'select', which is trivially bypassed by comments (-- select), subqueries, or stacked statements, and the vitess parser fell back to executing unparsed statements verbatim. Net: a real, confirmed vulnerability with an available patch, but exploitation depends on social-engineering a user into processing a hostile note, which keeps practical risk below what the 7.1 alone might suggest.

An attacker crafts a malicious .sy note document containing a block-query embed block whose SQL is non-read-only (e.g. VACUUM INTO '/path/leak.db' -- select to exfiltrate the database to an attacker-chosen file, or DELETE FROM blocks to destroy index data), then shares or syncs it to a victim. When the victim's SiYuan instance opens, indexes, renders, or exports the document, the SQL executes automatically against siyuan.db with no authentication or further action. No public exploit code was provided, though the vendor regression tests enumerate concrete bypass payloads.