Critical-Severity Flaw in github.com/siyuan-note/siyuan/kernel (go): SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keywo
A critical-severity advisory for the go package github.com/siyuan-note/siyuan/kernel is fixed in version 0.0.0-20260721043339-eef10568384e.
Key points
- github.com/siyuan-note/siyuan/kernel (go) has a critical flaw.
- Tracked as GHSA-33jq-p8c2-q3q4.
- Version 0.0.0-20260721043339-eef10568384e.
Maintainers of github.com/siyuan-note/siyuan/kernel, a package in the go ecosystem, have published a critical-severity security advisory (GHSA-33jq-p8c2-q3q4): SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking.
At a glance
- Advisory
- GHSA-33jq-p8c2-q3q4
- CVE
- Not assigned
- Package
- github.com/siyuan-note/siyuan/kernel (go)
- Severity
- Critical
- Patched in
- 0.0.0-20260721043339-eef10568384e
What is the issue?
The GitHub-reviewed advisory explains: Summary The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when Publish.Auth.Enable is false. The resulting statement runs on a read-write SQLite handle through a driver that executes stacked (;-separated) statements, against the global blocks table spanning all cleartext notebooks. An unauthenticated request can therefore read and write database content across every non-encrypted notebook on the instance. Details Data flow, unescaped and unbound at every hop: - searchDocs (kernel/api/filetree.go): k := arg["k"].(string) passed straight to model.SearchDocs(k, …), no sanitization. - SearchDocs (kernel/model/file.go): after TrimSpace and strings.Fields, each token is splice
Affected versions
| Ecosystem | Package | Vulnerable | Patched |
|---|---|---|---|
| go | github.com/siyuan-note/siyuan/kernel | < 0.0.0-20260721043339-eef10568384e | 0.0.0-20260721043339-eef10568384e |
The advisory lists a CVSS score of 10.0.
How to fix it
- Upgrade the affected package to the first patched version listed above.
- Rebuild and redeploy applications that bundle the vulnerable dependency.
- Run your dependency scanner (npm audit, pip-audit, Dependabot) to find transitive uses.
- Review the advisory references for workaround details if you cannot upgrade yet.
What to do and how to stay safe: GHSA-33jq-p8c2-q3q4
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
