https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T04:52:13.634203+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-93591 fkie_cve-2026-93591 2026-11-13T04:52:13.635795+00:00

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

 https://db.gcve.eu/vuln/ghsa-4m3r-2vx9-4x56 GHSA-4m3r-2vx9-4x56 2026-11-13T04:52:13.635863+00:00

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.