CVE-2026-69084: SiYuan Unauthenticated Arbitrary SQL Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vh22-h7hf-www7",
  "modified" : "2026-09-03T20:19:22Z",
  "published" : "2026-09-03T20:19:22Z",
  "aliases" : [ "CVE-2026-69084" ],
  "summary" : "SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write",
  "details" : "**CVE:** This vulnerability corresponds to [CVE-2026-69084](https://nvd.nist.gov/vuln/detail/CVE-2026-69084).\n\n### Summary\n\nThe `/api/search/searchEmbedBlock` endpoint passes a client-supplied SQL statement verbatim to the database with no validation. The endpoint is gated by `CheckAuth` only reachable by the publish RoleReader token, and by the anonymous account when `Publish.Auth.Enable` is `false`. The statement runs on the main read-write `siyuan.db` handle through a driver that executes stacked statements, with no single-statement or read-only guard. An unauthenticated request can therefore execute arbitrary SQL reading and writing content across all cleartext notebooks.\n\nUnlike SQL injection into a fixed query, this endpoint accepts a full SQL statement by design and simply fails to restrict who may call it or what the statement may do.\n\n### Details\n\nData flow verbatim, unvalidated:\n\n- `searchEmbedBlock` (`kernel/api/search.go`): `stmt := arg[\"stmt\"].(string)` passed directly to `model.SearchEmbedBlock(stmt, …)`. No validation.\n- `SearchEmbedBlock` → `SearchEmbedBlockInBox` → `sql.SelectBlocksRawStmtNoParse(stmt, …)` → `selectBlocksRawStmt` → `query(stmt)`.\n- `query()` (`kernel/sql/database.go`) calls `db.Query(stmt)` on the global `siyuan.db` handle.\n\n**Missing guards.** The comparable endpoints enforce restrictions this one omits:\n- `/api/query/sql` runs `CheckSingleStatement` (all modes) and `CheckReadonlyStatement` (readonly mode) and is route-gated `CheckAuth + CheckAdminRole + CheckReadonly`.\n- `fullTextSearchBlock` rejects the SQL search method for non-admins (`if method == 2 && !IsAdminRoleContext(c)`).\n\n`searchEmbedBlock` has none of these, no statement check, no read-only check, no admin gate.\n\n**Route/auth tier.** `router.go`: `Handle(\"POST\", \"/api/search/searchEmbedBlock\", model.CheckAuth, searchEmbedBlock)`, `CheckAuth` only. `CheckAuth` admits `RoleReader`, and the publish proxy forwards port-6808 traffic with a Reader JWT (anonymous account when publish auth is disabled). Anonymous/reader reachable.\n\n**Handle/stacking.** `query()` uses the global `siyuan.db` handle, the same read-write handle behind the accepted `searchDocs` finding. Driver is the vendored `88250/go-sqlite3` (mattn fork), whose connection `query` loops over `;`-separated statements, so stacked statements execute for their side effects. The DSN sets no `mode=ro` / `_query_only`, so the handle is read-write; `ATTACH` is available.\n\n**Post-hoc filter does not bound the statement.** `FilterEmbedBlocksByPublishAccess` runs on the returned slice *after* `query()` has executed. It filters rows; it cannot constrain what the statement did. Any write or `ATTACH` side effect has already occurred before the filter runs. It is not a security boundary for this sink.\n\n**Scope.** The main `blocks`/DB handle spans every opened cleartext notebook. Encrypted notebooks use separate per-box databases and are excluded.\n\n### Impact\n\nAn unauthenticated request (publish mode with auth disabled) or any publish `RoleReader` executes arbitrary SQL on the main read-write database. This permits cross-notebook read disclosure of document content, and via the read-write handle and statement stacking, modification of database content and `ATTACH`-reachable files. No admin role, CSRF token, or write permission through the normal API is required. Encrypted notebooks are not exposed. Code execution is not reachable in the default build (no `load_extension`).\n\n### PoC Steps\n\n1. Build the kernel image from pinned HEAD\n\n`docker build -f D:/bb/zitadel/chatto/siyuan/Dockerfile.poc -t siyuan-head D:/bb/zitadel/chatto/siyuan`\n\n2. Run fresh, workspace mounted to the host\n\n```\ndocker rm -f siyuan-poc 2>nul\ndocker run -d --name siyuan-poc -p 6806:6806 -p 6808:6808 -v D:/bb/siyuan:/siyuan/workspace siyuan-head serve --accessAuthCode=1234567 --port=6806\n```\n\nConfirm it booted (version string back, not Cobra help):\n\n```\ndocker logs siyuan-poc\ncurl -s http://127.0.0.1:6806/api/system/version\n```\n\n3. Grab the admin API token from the host file. Use that value wherever TOKEN appears below (yours was g4wj3r04ntobe9m4).\n\n4. Turn on the reader surface: publish on 6808, Basic Auth OFF\n\n`curl -s -X POST http://127.0.0.1:6806/api/setting/setPublish -H \"Content-Type: application/json\" -H \"Authorization: Token TOKEN\" -d \"{\\\"enable\\\":true,\\\"port\\\":6808,\\\"auth\\\":{\\\"enable\\\":false,\\\"accounts\\\":[]}}\"`\n\nMust return \"data\":{\"port\":6808,...} (non-zero port = bound OK). Port 6808, not 6806.\n\n5. THE PROOF: anonymous reader on 6808, no token (the differential)\n\nGuarded sibling rejects reader SQL:\n`curl -i -X POST http://127.0.0.1:6808/api/search/fullTextSearchBlock -H \"Content-Type: application/json\" -d \"{\\\"query\\\":\\\"SELECT * FROM blocks LIMIT 1\\\",\\\"method\\\":2}\"`\n\n→ -1 / \"SQL search requires administrator privileges\"\n\nsearchEmbedBlock accepts the same reader SQL (no guard):\n`curl -i -X POST http://127.0.0.1:6808/api/search/searchEmbedBlock -H \"Content-Type: application/json\" -d \"{\\\"embedBlockID\\\":\\\"\\\",\\\"stmt\\\":\\\"SELECT * FROM blocks LIMIT 1\\\",\\\"excludeIDs\\\":[]}\"`\n→ HTTP 200 / code:0 : arbitrary SQL executed at the anonymous reader tier. This pair is the finding.\n\n### Suggested fix\n\nApply the same controls the sibling SQL endpoints already use: route `searchEmbedBlock` through `CheckSingleStatement` and `CheckReadonlyStatement`, and gate the raw-SQL capability behind `CheckAdminRole` (as `/api/query/sql` and `fullTextSearchBlock`'s SQL method do). At minimum, the read paths should run on a `_query_only=1` handle so a reader-reachable statement cannot write or `ATTACH`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/siyuan-note/siyuan/kernel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260721002947-23a17d44b5f3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-69084"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/commit/0015cbafbf685363b217bbc46283a3c0f51c79fa"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/commit/23a17d44b5f3da59c85e7fbee11236e6c12386b9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/siyuan-note/siyuan"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-03T20:19:22Z",
    "nvd_published_at" : null
  }
}