CVE-2026-93591: SiYuan: SQL injection in getGraph exposes private notes

HIGHPoC AVAILABLECISA: TRACK*

Published September 18, 2026

CISO Take

SiYuan versions before 3.8.3 concatenate tag values straight into SQL string literals in the graph query code, so a publish-mode reader or even an anonymous visitor can inject SQL through inline HTML span tags in the getGraph endpoint. The injected queries run against the read-write database, which lets an attacker exfiltrate private data across notebooks and, with lower impact, alter or disrupt data. A public proof-of-concept exists and the attack needs no user interaction and low complexity, but the EPSS score is only 0.00316 (top 77% percentile). The CVE is not in CISA KEV and CISA SSVC rates it TRACK*, so there is no confirmed active exploitation yet. Upgrade to SiYuan 3.8.3 or later right away, and if you can't patch quickly, take any publish-mode instance off the internet. Review those instances for unexpected getGraph requests.

Sources:NVDEPSSGitHub AdvisoryVulnCheckATLAS

What is the risk?

High (CVSS 7.6). The flaw is network-reachable, low complexity, needs no user interaction and low privileges (publish-mode reader or anonymous visitor). Confidentiality impact is high because the attacker can read data across notebooks. Integrity and availability impact are low, but the database is read-write. A public PoC exists, while EPSS (0.00316) and the lack of KEV listing indicate exploitation is not yet observed at scale. Exposure is greatest for internet-facing publish-mode instances. The package is only tangentially AI: SiYuan is a personal knowledge management tool, and its risk to AI/ML systems comes from the sensitive notes, credentials or research data users store in it.

How does the attack unfold?

Initial Access

The attacker reaches a publish-mode SiYuan instance anonymously or as a publish-mode reader.

AML.T0049

Exploitation

A crafted inline HTML span tag sends an unescaped tag value into query2Stmt via the getGraph endpoint, injecting SQL.

AML.T0049

Collection

Injected queries read data from private notebooks in the shared read-write database.

AML.T0036

Impact

Notes, credentials and AI project documentation are exfiltrated, and limited data tampering is possible.

AML.T0025

Initial Access

The attacker reaches a publish-mode SiYuan instance anonymously or as a publish-mode reader.

AML.T0049

Exploitation

A crafted inline HTML span tag sends an unescaped tag value into query2Stmt via the getGraph endpoint, injecting SQL.

AML.T0049

Collection

Injected queries read data from private notebooks in the shared read-write database.

AML.T0036

Impact

Notes, credentials and AI project documentation are exfiltrated, and limited data tampering is possible.

AML.T0025

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

ILow

ALow

What should I do?

6 steps

Upgrade SiYuan to version 3.8.3 or later.
Until patched, disable publish mode or restrict access to the publish service with network controls, a VPN or an authenticating reverse proxy.
Add WAF or proxy rules to block getGraph requests containing single quotes, SQL keywords or HTML span tags in tag parameters.
Review access logs for anomalous getGraph requests from unauthenticated or unfamiliar sources.
Rotate any API keys, tokens or credentials stored in notebooks on instances that were publicly exposed.
Back up the database and verify note integrity on exposed instances.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageFrameworkAPIAML.T0025- Exfiltration via Cyber Means AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Quality and security of data for AI systems

NIST AI RMF

MANAGE 2.3-Risk treatment and response to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-93591?

Is CVE-2026-93591 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-93591, increasing the risk of exploitation.

How to fix CVE-2026-93591?

1. Upgrade SiYuan to version 3.8.3 or later. 2. Until patched, disable publish mode or restrict access to the publish service with network controls, a VPN or an authenticating reverse proxy. 3. Add WAF or proxy rules to block getGraph requests containing single quotes, SQL keywords or HTML span tags in tag parameters. 4. Review access logs for anomalous getGraph requests from unauthenticated or unfamiliar sources. 5. Rotate any API keys, tokens or credentials stored in notebooks on instances that were publicly exposed. 6. Back up the database and verify note integrity on exposed instances.

What systems are affected by CVE-2026-93591?

This vulnerability affects the following AI/ML architecture patterns: Knowledge management platforms, AI research documentation, Self-hosted AI tooling.

What is the CVSS score for CVE-2026-93591?

CVE-2026-93591 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

Knowledge management platformsAI research documentationSelf-hosted AI tooling

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

Exploitation Scenario

An attacker finds an internet-facing SiYuan publish-mode instance used by an AI research team to document model experiments. Without logging in, they send a crafted getGraph request containing an inline HTML span tag whose tag value includes a single quote and a SQL payload. Because the query2Stmt function does not escape the value, the payload executes against the read-write database and returns content from private notebooks, such as API keys, prompt libraries and internal model evaluation notes. The attacker then uses the stolen credentials to reach cloud AI services or training infrastructure.

Weaknesses (CWE)

CWE-89Improper Neutralization of Special Elements used in an SQL CommandPrimary CWE-89Improper Neutralization of Special Elements used in an SQL Command

CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]

Source: MITRE CWE corpus.