CVE-2026-69083: Jupyter Notebook unauthenticated

Q: Is CVE-2026-69083 actively exploited?

No confirmed active exploitation of CVE-2026-69083 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69083?

1) Upgrade to SiYuan v3.7.3 or later immediately — this is the primary and only durable fix. 2) Until patched, do not expose the SiYuan HTTP API/web interface directly to the internet; place it behind a VPN, reverse-proxy authentication layer, or IP allowlist. 3) Review and rotate any RoleReader tokens, and audit how they are issued/shared (e.g., via publish links) since the flaw is reachable through these public tokens. 4) Monitor database and application logs for anomalous fullTextSearchAssetContent requests containing REGEXP or SQL metacharacters (quotes, UNION, comments) as a detection signal. 5) If SiYuan feeds notes/documents into any downstream RAG or agent pipeline, treat that data as potentially tainted until the instance is confirmed patched and audited for prior tampering.

Q: What systems are affected by CVE-2026-69083?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, knowledge management / document stores.

Q: What is the CVSS score for CVE-2026-69083?

CVE-2026-69083 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.35%.

CISO Take

SiYuan, a self-hosted note-taking and knowledge-base tool, contains a critical SQL injection in its fullTextSearchAssetContent endpoint that unauthenticated attackers can trigger by abusing publicly-issued RoleReader tokens, letting them craft REGEXP-based payloads to read, modify, or delete data across notebooks in the asset-content database. With a CVSS of 10.0, network attack vector, no privileges or user interaction required, and no available patch version listed, any internet-facing SiYuan instance is fully exposed to remote data theft or destruction. There is no evidence of active exploitation (not in CISA KEV, EPSS only 0.35%, no public PoC or Nuclei template), and CISA's SSVC decision is ATTEND rather than immediate action, so this is a serious-but-not-yet-weaponized risk. Because SiYuan is frequently used to store proprietary notes, credentials, research, and internal documentation — including AI/ML project notes and prompts — a successful exploit could expose sensitive intellectual property. Upgrade to SiYuan v3.7.3 or later immediately; until patched, do not expose SiYuan instances directly to the internet, restrict access via VPN or IP allowlisting, and audit RoleReader token issuance and asset-content database logs for anomalous REGEXP-heavy queries.

Sources: NVD GitHub Advisory EPSS

What is the risk?

Critical severity (CVSS 10.0) driven by unauthenticated, network-reachable, low-complexity exploitation with no user interaction and confidentiality/integrity impact across notebook boundaries. Mitigating factors keeping real-world risk moderate for now: EPSS is very low (0.35%, 72nd percentile), there is no public exploit code or Nuclei template, and it is absent from CISA KEV — meaning opportunistic mass exploitation has not yet been observed. However, the combination of a trivially exploitable SQLi class (CWE-89), no authentication barrier, and a self-hosted product that is often deployed with direct internet exposure (common in personal knowledge-management setups) means the exposure window is real and the barrier to a working exploit is low for any attacker who reads the advisory or reverse-engineers the patch diff. Risk should be treated as HIGH until patched, not CRITICAL-active, given the absence of ITW exploitation signals.

How does the attack unfold?

Initial Access

Attacker locates an internet-exposed SiYuan instance and obtains a publicly-issued RoleReader token via a shared publish link.

AML.T0049

Exploitation

Attacker sends a crafted method parameter with a malicious REGEXP clause to the unauthenticated fullTextSearchAssetContent endpoint, injecting arbitrary SQL.

Impact

Attacker reads, modifies, or deletes cross-notebook data in the asset-content database, exposing or corrupting stored notes and any downstream AI/RAG content sourced from them.

Initial Access

Attacker locates an internet-exposed SiYuan instance and obtains a publicly-issued RoleReader token via a shared publish link.

AML.T0049

Exploitation

Attacker sends a crafted method parameter with a malicious REGEXP clause to the unauthenticated fullTextSearchAssetContent endpoint, injecting arbitrary SQL.

Impact

Attacker reads, modifies, or deletes cross-notebook data in the asset-content database, exposing or corrupting stored notes and any downstream AI/RAG content sourced from them.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	go	< 0.0.0-20260721004815-cf42dd5680c8	`0.0.0-20260721004815-cf42dd5680c8`
13.3K OpenSSF 5.7 3.0K dependents Pushed 9d ago 83% patched ~108d to patch Full package profile →
siyuan	—	—	No patch

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A None

What should I do?

1 step

1) Upgrade to SiYuan v3.7.3 or later immediately — this is the primary and only durable fix. 2) Until patched, do not expose the SiYuan HTTP API/web interface directly to the internet; place it behind a VPN, reverse-proxy authentication layer, or IP allowlist. 3) Review and rotate any RoleReader tokens, and audit how they are issued/shared (e.g., via publish links) since the flaw is reachable through these public tokens. 4) Monitor database and application logs for anomalous fullTextSearchAssetContent requests containing REGEXP or SQL metacharacters (quotes, UNION, comments) as a detection signal. 5) If SiYuan feeds notes/documents into any downstream RAG or agent pipeline, treat that data as potentially tainted until the instance is confirmed patched and audited for prior tampering.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage RAG AML.T0049 - Exploit Public-Facing Application AML.T0064 - Gather RAG-Indexed Targets

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.2 - Data for AI systems

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-69083?

SiYuan, a self-hosted note-taking and knowledge-base tool, contains a critical SQL injection in its fullTextSearchAssetContent endpoint that unauthenticated attackers can trigger by abusing publicly-issued RoleReader tokens, letting them craft REGEXP-based payloads to read, modify, or delete data across notebooks in the asset-content database. With a CVSS of 10.0, network attack vector, no privileges or user interaction required, and no available patch version listed, any internet-facing SiYuan instance is fully exposed to remote data theft or destruction. There is no evidence of active exploitation (not in CISA KEV, EPSS only 0.35%, no public PoC or Nuclei template), and CISA's SSVC decision is ATTEND rather than immediate action, so this is a serious-but-not-yet-weaponized risk. Because SiYuan is frequently used to store proprietary notes, credentials, research, and internal documentation — including AI/ML project notes and prompts — a successful exploit could expose sensitive intellectual property. Upgrade to SiYuan v3.7.3 or later immediately; until patched, do not expose SiYuan instances directly to the internet, restrict access via VPN or IP allowlisting, and audit RoleReader token issuance and asset-content database logs for anomalous REGEXP-heavy queries.

Is CVE-2026-69083 actively exploited?

No confirmed active exploitation of CVE-2026-69083 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69083?

1) Upgrade to SiYuan v3.7.3 or later immediately — this is the primary and only durable fix. 2) Until patched, do not expose the SiYuan HTTP API/web interface directly to the internet; place it behind a VPN, reverse-proxy authentication layer, or IP allowlist. 3) Review and rotate any RoleReader tokens, and audit how they are issued/shared (e.g., via publish links) since the flaw is reachable through these public tokens. 4) Monitor database and application logs for anomalous fullTextSearchAssetContent requests containing REGEXP or SQL metacharacters (quotes, UNION, comments) as a detection signal. 5) If SiYuan feeds notes/documents into any downstream RAG or agent pipeline, treat that data as potentially tainted until the instance is confirmed patched and audited for prior tampering.

What systems are affected by CVE-2026-69083?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, knowledge management / document stores.

What is the CVSS score for CVE-2026-69083?

CVE-2026-69083 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesknowledge management / document stores

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0064 Gather RAG-Indexed Targets

Compliance Controls Affected

ISO 42001: A.7.2

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

Exploitation Scenario

An attacker discovers an internet-exposed SiYuan instance (via Shodan/censys fingerprinting or a shared publish link that includes a RoleReader token) and sends a crafted request to the fullTextSearchAssetContent endpoint with a malicious REGEXP/method parameter. Because the endpoint is reachable without authentication beyond the reader token and input is not sanitized, the payload executes arbitrary SQL against the asset-content database, allowing the attacker to enumerate and dump notebooks across users, modify note content (including any prompts, credentials, or research feeding an internal AI workflow), or delete data entirely — all without needing valid write credentials or triggering any user interaction.

Weaknesses (CWE)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]

Source: MITRE CWE corpus.