{"uuid": "2cde6466-633d-4e46-8e33-8b535c93bc32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72807", "type": "seen", "source": "https://gist.github.com/alon710/428fa3e523bd4efb06d0f15759388e47", "content": "# CVE-2026-72807: CVE-2026-72807: Second-Order SQL Injection via Attribute View Templates in SiYuan\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72807\n\n## Summary\nCVE-2026-72807 is a second-order SQL injection vulnerability in SiYuan versions prior to v3.7.4. It resides in the dynamic evaluation of Attribute View (AV) template columns, which expose unsafe template functions. An attacker can exploit this by distributing a malicious SiYuan package that executes arbitrary SQL queries on the victim's local database.\n\n## TL;DR\nUnauthenticated second-order SQL injection in SiYuan personal knowledge management system via malicious dynamic icon template rendering in Attribute Views.\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.8 (High)\n- **EPSS Score**: 0.00199 (Percentile: 9.77%)\n- **Exploit Status**: No public PoC\n- **CISA KEV Status**: Not Listed\n- **Impact**: Arbitrary read/write database access\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later immediately.\n- Inspect external .sy files and imported notebooks for dynamic Go templates containing SQL utility commands before importing.\n\n**Remediation Steps:**\n1. Identify all active installations of SiYuan in the environment.\n2. Verify the version is lower than 3.7.4.\n3. Download and apply the patch for version 3.7.4 or later from official channels.\n4. Configure import policies to prevent untrusted personal knowledge management packages from executing automatically.\n\n## References\n\n- [https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3)\n- [https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-template](https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-template)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72807) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T07:31:42.160368Z"}