SiYuan CVE-2026-116170

Exploitation requires a valid SiYuan admin API token - the attacker must already hold admin credentials, obtain the token from the workspace config (ws/conf/conf.json), complete the login flow, or run as/within a client that has the token (e.g. a malicious plugin or the MCP history tool). The vulnerable path is reached via POST /api/history/searchHistory or /api/history/getHistoryItems: the op field is always injectable, while query is injectable only when type=3 (search-by-doc-ID), because the stringQuery escaping is deliberately skipped for that type. There is no non-default feature toggle - the behavior exists in all builds <= 3.8.6. The limiting factor is the admin-token requirement (PR:H); this is not remote-unauthenticated and does not affect integrity or availability, as the sink is read-only against history.db.

This is a genuine but constrained issue, best characterized as a privileged, read-only data-exfiltration flaw rather than a drive-by compromise. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) is internally consistent with the GHSA evidence: exploitation is network-reachable and low-complexity, but requires high privileges (PR:H) because every affected endpoint (searchHistory, getHistoryItems, the MCP history tool) is admin-token-gated per api/router.go:236-237. Impact is confidentiality-only (VC:H, VI:N/VA:N) - a read-only UNION SELECT against history.db exposing deleted document content, titles and paths - which the score of 6.9 (Medium) reflects fairly. The vuln.today Decision label is 'this_month', indicating a prioritized-but-not-emergency fix cadence, consistent with the PR:H gating. The GHSA advisory includes a detailed, author-verified PoC (run live against a source-built v3.8.6 kernel), so working exploitation technique is public; this raises likelihood for anyone who can present an admin token (including a malicious plugin). No EPSS score is provided and the CVE is not listed in CISA KEV, so there is no evidence of active in-the-wild exploitation - the realistic threat is a malicious/compromised plugin or a leaked admin token, not mass internet-facing attack. Net: a real, patch-this-month priority for SiYuan operators, but the PR:H prerequisite keeps it below critical.

An attacker who already holds (or tricks a user into installing a plugin that holds) a SiYuan admin token sends a crafted POST to /api/history/getHistoryItems with type=3 and a query such as x' UNION SELECT id,type,op,title,content,path,created FROM histories_fts_case_insensitive --, which is concatenated unescaped into the SQL executed against history.db. This exfiltrates bulk document history - including previously deleted document content, titles and paths - beyond what the structured API exposes. A detailed, author-verified PoC for this exact sequence is published in the GHSA advisory.