CVE-2026-93591 Overview
CVE-2026-93591 is an SQL injection vulnerability [CWE-89] affecting SiYuan versions prior to 3.8.3. SiYuan is a personal knowledge management system that supports a publish mode for sharing notebooks with readers. The flaw resides in the query2Stmt function within graph.go, which concatenates tag values directly into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can craft inline HTML <span> tags containing SQL payloads and submit them to the getGraph endpoint. The injected SQL executes against the read-write database, allowing exfiltration of private notebook content across the entire instance.
Critical Impact
Anonymous or low-privilege visitors can execute arbitrary SQL queries against the SiYuan database and exfiltrate private notes from other notebooks.
Affected Products
- SiYuan versions before 3.8.3
- SiYuan instances running in publish mode with anonymous access
- Self-hosted SiYuan deployments exposing the getGraph endpoint
Discovery Timeline
- 2026-09-18 - CVE-2026-93591 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-93591
Vulnerability Analysis
The vulnerability originates in the query2Stmt function inside graph.go. This function transforms user-supplied tag values into an SQL WHERE clause used by the graph-rendering feature. Rather than parameterizing the query or escaping input, the function concatenates the tag string directly into a single-quoted SQL literal. An attacker who supplies a single quote inside the tag value breaks out of the string context and appends arbitrary SQL. The getGraph endpoint accepts these tag values as inline HTML <span> elements, which the parser extracts and forwards to the vulnerable query builder. Because publish mode exposes the endpoint to unauthenticated visitors, the attack surface reaches the public internet on any exposed instance.
Root Cause
The root cause is missing input sanitization and use of raw string concatenation to build SQL statements. Single quotes in tag values are not escaped or replaced before being embedded in the query literal. The database connection used by getGraph is read-write, so the impact is not limited to the graph feature and extends to any table accessible from that connection.
Attack Vector
An attacker submits a crafted request to the getGraph endpoint containing an inline HTML <span> element whose tag attribute carries an SQL injection payload. The payload closes the intended string literal, appends a UNION SELECT or similar construct, and reads data from arbitrary tables. Exploitation requires only network reach to a publish-mode instance and does not require authentication in publish scenarios. Successful exploitation returns confidential note contents from notebooks the visitor is not authorized to view.
For implementation-level details, refer to the GitHub Security Advisory GHSA-5rwv-4j4c-f954 and the VulnCheck SQL Injection Advisory.
Detection Methods for CVE-2026-93591
Indicators of Compromise
- HTTP requests to the getGraph endpoint containing single quotes, UNION, SELECT, or SQL comment sequences inside <span> tag attributes.
- Unexpected outbound data volume from the SiYuan process following requests to graph-related endpoints.
- Application logs showing malformed or unusually long tag parameters submitted by unauthenticated publish-mode sessions.
Detection Strategies
- Deploy web application firewall rules that inspect request bodies to /api/graph/getGraph for SQL metacharacters within HTML span attributes.
- Enable SQL query logging on the SiYuan database and alert on UNION SELECT statements or queries referencing tables outside the graph feature scope.
- Review reverse proxy access logs for anonymous requests to graph endpoints originating from unfamiliar IP ranges.
Monitoring Recommendations
- Baseline normal getGraph request patterns and alert on payload length or character-set anomalies.
- Monitor SiYuan process file access for reads of notebook data files not associated with the active user session.
- Correlate spikes in graph endpoint traffic with subsequent egress to external hosts.
How to Mitigate CVE-2026-93591
Immediate Actions Required
- Upgrade SiYuan to version 3.8.3 or later, which contains the fix for the query2Stmt injection flaw.
- Disable publish mode on internet-facing instances until the upgrade is applied.
- Place vulnerable instances behind an authenticating reverse proxy to block anonymous access to getGraph.
Patch Information
The SiYuan maintainers addressed CVE-2026-93591 in version 3.8.3. The patch introduces proper escaping of single quotes in tag values before they are concatenated into the SQL literal in graph.go. Administrators should consult the GitHub Security Advisory GHSA-5rwv-4j4c-f954 for the exact commit reference and upgrade notes.
Workarounds
- Restrict network access to the SiYuan instance to trusted IP ranges via firewall or reverse-proxy allowlists.
- Require HTTP basic authentication on the reverse proxy in front of publish-mode endpoints.
- Run SiYuan with a database account that has read-only access where feature compatibility allows.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
