CVE-2026-69084: Jupyter Notebook SQL injection

Q: Is CVE-2026-69084 actively exploited?

No confirmed active exploitation of CVE-2026-69084 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69084?

1) Upgrade to SiYuan v3.7.3 or later immediately — this is the vendor-confirmed fix. 2) Until patched, disable publish/sharing features entirely, or if publish must stay on, ensure publish authentication is enabled (never run with publish auth disabled on an internet-reachable instance). 3) Do not expose SiYuan's API directly to the internet; front it with a reverse proxy that restricts /api/search/searchEmbedBlock to trusted IPs or requires strong authentication. 4) Rotate any publish RoleReader tokens after patching, since they may have been used to reach the vulnerable endpoint pre-fix. 5) For detection, review proxy/access logs for repeated or anomalous POSTs to /api/search/searchEmbedBlock, especially containing SQL metacharacters or multiple semicolon-delimited statements, and for the presence of Nuclei-style scan signatures (rapid sequential probing of known SiYuan paths).

Q: What systems are affected by CVE-2026-69084?

This vulnerability affects the following AI/ML architecture patterns: self-hosted knowledge-management / notebook applications, internal documentation stores feeding downstream AI/RAG workflows.

Q: What is the CVSS score for CVE-2026-69084?

CVE-2026-69084 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 1.10%.

CISO Take

SiYuan, a self-hosted note-taking and knowledge-management app, passes a client-supplied SQL statement verbatim to its main read-write database through the /api/search/searchEmbedBlock endpoint, and because the underlying driver executes stacked statements, a single request can both read and modify data rather than just query it. The endpoint's only gate is CheckAuth, so it is reachable with the low-privilege publish RoleReader token and, on any instance running with publish authentication disabled, by completely anonymous users, which materially widens the exposed attack surface for self-hosted or shared deployments. There is no confirmed active exploitation and no public PoC, and EPSS sits at 0.9% (top 43rd percentile) — modest real-world exploitation pressure today — but a Nuclei template already exists, so mass automated scanning for vulnerable instances is trivially achievable, and the CVSS 10 score (full confidentiality and integrity loss, no authentication or user interaction required) reflects real blast radius across every cleartext, non-encrypted notebook the instance has open. Patch to v3.7.3 immediately on any internet-facing or publish-enabled SiYuan instance; until patched, disable public/publish access or restrict RoleReader tokens to a trusted network, and check reverse-proxy or app logs for POST requests to /api/search/searchEmbedBlock containing SQL keywords (UNION, ;, DROP, UPDATE, --) as an indicator of scanning or exploitation attempts.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Critical on paper (CVSS 10, AV:N/AC:L/PR:N/UI:N) and trivial to exploit — no authentication needed when publish auth is disabled, and only a low-privilege token otherwise. Real-world urgency is tempered by a low EPSS score (0.9%, ~43rd percentile) and no CISA KEV listing, and CISA's own SSVC decision is ATTEND rather than ACT/immediate, meaning track and patch on a normal cycle rather than treat as under active mass exploitation. However, the existence of a public Nuclei template means opportunistic internet-wide scanning is likely regardless of targeted intent, so any exposed, unpatched instance should be treated as a live risk, not a theoretical one.

How does the attack unfold?

Initial Access

Attacker identifies an internet-facing SiYuan instance (<=v3.7.2) with publish sharing enabled, reachable anonymously or via a low-privilege RoleReader token, often via automated scanning with the public Nuclei template.

AML.T0049

Exploitation

Attacker sends a crafted SQL payload with stacked statements to /api/search/searchEmbedBlock, which CheckAuth alone fails to block.

Data Access

The malicious SQL executes directly against the live read-write siyuan.db, letting the attacker read content across all opened cleartext notebooks.

AML.T0037

Impact

Beyond disclosure, the attacker can modify or delete notebook content via the same stacked-statement injection, corrupting data that may be trusted by downstream processes.

Initial Access

Attacker identifies an internet-facing SiYuan instance (<=v3.7.2) with publish sharing enabled, reachable anonymously or via a low-privilege RoleReader token, often via automated scanning with the public Nuclei template.

AML.T0049

Exploitation

Attacker sends a crafted SQL payload with stacked statements to /api/search/searchEmbedBlock, which CheckAuth alone fails to block.

Data Access

The malicious SQL executes directly against the live read-write siyuan.db, letting the attacker read content across all opened cleartext notebooks.

AML.T0037

Impact

Beyond disclosure, the attacker can modify or delete notebook content via the same stacked-statement injection, corrupting data that may be trusted by downstream processes.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	go	< 0.0.0-20260721002947-23a17d44b5f3	`0.0.0-20260721002947-23a17d44b5f3`
13.3K OpenSSF 5.7 3.0K dependents Pushed 9d ago 83% patched ~108d to patch Full package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

1.1%

chance of exploitation in 30 days

Higher than 64% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Nuclei detection template available

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A None

What should I do?

1 step

1) Upgrade to SiYuan v3.7.3 or later immediately — this is the vendor-confirmed fix. 2) Until patched, disable publish/sharing features entirely, or if publish must stay on, ensure publish authentication is enabled (never run with publish auth disabled on an internet-reachable instance). 3) Do not expose SiYuan's API directly to the internet; front it with a reverse proxy that restricts /api/search/searchEmbedBlock to trusted IPs or requires strong authentication. 4) Rotate any publish RoleReader tokens after patching, since they may have been used to reach the vulnerable endpoint pre-fix. 5) For detection, review proxy/access logs for repeated or anomalous POSTs to /api/search/searchEmbedBlock, especially containing SQL metacharacters or multiple semicolon-delimited statements, and for the presence of Nuclei-style scan signatures (rapid sequential probing of known SiYuan paths).

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Data Leakage API Plugin AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - Information security for AI systems

Frequently Asked Questions

What is CVE-2026-69084?

SiYuan, a self-hosted note-taking and knowledge-management app, passes a client-supplied SQL statement verbatim to its main read-write database through the /api/search/searchEmbedBlock endpoint, and because the underlying driver executes stacked statements, a single request can both read and modify data rather than just query it. The endpoint's only gate is CheckAuth, so it is reachable with the low-privilege publish RoleReader token and, on any instance running with publish authentication disabled, by completely anonymous users, which materially widens the exposed attack surface for self-hosted or shared deployments. There is no confirmed active exploitation and no public PoC, and EPSS sits at 0.9% (top 43rd percentile) — modest real-world exploitation pressure today — but a Nuclei template already exists, so mass automated scanning for vulnerable instances is trivially achievable, and the CVSS 10 score (full confidentiality and integrity loss, no authentication or user interaction required) reflects real blast radius across every cleartext, non-encrypted notebook the instance has open. Patch to v3.7.3 immediately on any internet-facing or publish-enabled SiYuan instance; until patched, disable public/publish access or restrict RoleReader tokens to a trusted network, and check reverse-proxy or app logs for POST requests to /api/search/searchEmbedBlock containing SQL keywords (UNION, ;, DROP, UPDATE, --) as an indicator of scanning or exploitation attempts.

Is CVE-2026-69084 actively exploited?

No confirmed active exploitation of CVE-2026-69084 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69084?

1) Upgrade to SiYuan v3.7.3 or later immediately — this is the vendor-confirmed fix. 2) Until patched, disable publish/sharing features entirely, or if publish must stay on, ensure publish authentication is enabled (never run with publish auth disabled on an internet-reachable instance). 3) Do not expose SiYuan's API directly to the internet; front it with a reverse proxy that restricts /api/search/searchEmbedBlock to trusted IPs or requires strong authentication. 4) Rotate any publish RoleReader tokens after patching, since they may have been used to reach the vulnerable endpoint pre-fix. 5) For detection, review proxy/access logs for repeated or anomalous POSTs to /api/search/searchEmbedBlock, especially containing SQL metacharacters or multiple semicolon-delimited statements, and for the presence of Nuclei-style scan signatures (rapid sequential probing of known SiYuan paths).

What systems are affected by CVE-2026-69084?

This vulnerability affects the following AI/ML architecture patterns: self-hosted knowledge-management / notebook applications, internal documentation stores feeding downstream AI/RAG workflows.

What is the CVSS score for CVE-2026-69084?

CVE-2026-69084 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 1.10%.

What is the AI security impact?

Affected AI Architectures

self-hosted knowledge-management / notebook applicationsinternal documentation stores feeding downstream AI/RAG workflows

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

What are the technical details?

Original Advisory

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

Exploitation Scenario

An attacker finds an internet-facing SiYuan instance (via Shodan/Nuclei mass scanning, since a template already exists) with publish sharing enabled and either no publish auth or a leaked/guessed RoleReader token. They send a crafted request to /api/search/searchEmbedBlock containing a malicious SQL payload with stacked statements — for example, a SELECT to dump note content followed by an UPDATE or DELETE to tamper with or destroy specific blocks. Because CheckAuth is the only control and the query runs directly against the live, read-write siyuan.db with no single-statement or read-only restriction, the attacker exfiltrates the full contents of every cleartext notebook the instance has open and can silently modify or corrupt records — for example planting false information in notes that a downstream AI summarization or search workflow later treats as trusted source material.

Weaknesses (CWE)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Primary CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]

Source: MITRE CWE corpus.