SiYuan EUVD-2026-57408

Exploitation requires two specific conditions to be met: first, the victim must import a SiYuan document or installable package that contains an attribute-view with a malicious template column referencing the queryBlocks function; second, the imported content must be rendered by the SiYuan kernel, which triggers evaluation of the template column. The attribute-view template column feature invoking queryBlocks must be present and enabled, which appears to be part of default SiYuan functionality rather than a non-default configuration. Exploitation is limited by: (1) mandatory user interaction - the victim must actively obtain and import the crafted package, requiring a social-engineering step; (2) the attacker has no direct network access to the victim's kernel and cannot trigger the injection without the victim performing the import action; and (3) impact is scoped to the victim's local SiYuan database and notebooks, not the broader operating system or other applications. There is no indication that default SiYuan deployments expose the kernel to the network in a manner enabling direct unauthenticated injection without the document import prerequisite.

The CVSS 4.0 score of 8.8 is driven by high confidentiality and integrity impacts on both vulnerable (VC:H/VI:H) and subsequent systems (SC:H/SI:H), reflecting unrestricted read and write access to all notebook data. AC:H and AT:P are appropriate - the attacker must craft a valid SiYuan package and route it to a victim who imports it, introducing real social-engineering friction. UI:P acknowledges passive user interaction (import action). EPSS data was not provided in the available intelligence, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV and no POC code is confirmed, which meaningfully reduces immediate opportunistic risk. Real-world risk is moderate-to-high for users who regularly import packages or documents from community repositories or untrusted parties; risk is low for purely offline, single-user deployments that never import external packages. The second-order nature makes this harder to detect at runtime than a conventional injection, and defenders relying solely on import-time scanning may have false confidence.

An attacker publishes a malicious SiYuan note package to a community sharing platform or sends it directly to a target, embedding a crafted SQL payload within an attribute-view template column that invokes queryBlocks. When the victim downloads and imports the package into their SiYuan instance and the template column is rendered, the kernel executes the injected SQL against the local database, enabling the attacker's payload to exfiltrate all notebook content or insert malicious data across the workspace. No POC code has been confirmed, but the attack requires only knowledge of SiYuan's template syntax and a social-engineering vector to deliver the package.