SiYuan EUVD-2026-52277

Requires network reachability to the SiYuan HTTP API endpoint /api/search/searchEmbedBlock on a vulnerable instance (<= v3.7.2). The endpoint is protected only by CheckAuth, so exploitation succeeds either with the publish RoleReader token or fully anonymously when publish authentication is disabled - the latter being the true PR:N case. The attack targets content in opened cleartext notebooks only; encrypted per-box notebooks are excluded and thus limit the blast radius. The key limiting factor is deployment posture: an instance not exposed to untrusted networks, or one with publish authentication enabled, raises the bar from anonymous to token-holding access. No user interaction is required.

The signals are strongly aligned toward high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation with no user interaction, and the vulnerable-system impacts VC:H/VI:H plus subsequent-system SC:H/SI:H yield a 9.9 base score reflecting both confidentiality and integrity loss extending beyond the immediate component. The stacked-query capability makes the technical impact 'total' for the data plane (read and write). Reporting by VulnCheck (a credible exploit-intelligence vendor) and an existing GHSA advisory raise confidence in the finding. Countervailing context: PR:N is only fully accurate when publish authentication is disabled; in a hardened deployment the endpoint still requires the publish RoleReader token, which is a low bar but not truly anonymous - so real-world exposure depends on configuration. No EPSS score, KEV listing, or public POC was provided, so despite the critical rating there is no evidence of active or automated exploitation yet; treat this as high-urgency-to-patch rather than confirmed in-the-wild.

An attacker who can reach a self-hosted SiYuan publish endpoint (either anonymously where publish auth is disabled, or with a low-privilege RoleReader token) sends a crafted request to /api/search/searchEmbedBlock containing a stacked SQL payload. The first statement exfiltrates block content from cleartext notebooks, while a trailing statement (after a semicolon) issues UPDATE/DELETE/INSERT operations to tamper with or destroy notes. No public POC was provided, but the low complexity and unauthenticated network vector make exploitation straightforward once the endpoint is exposed.