SiYuan Backlink/Mention Search: Unescaped Single Quotes Enable SQL Injection on the Publish Surface (CVE-2026-72811)

A newly published GitHub Security Advisory (GHSA-q2vg-7qgx-x5fc, CVE-2026-72811, CVSS 10.0) reports a SQL injection vulnerability in SiYuan's backlink/mention search functionality (kernel/model/backlink.go). According to the advisory, the query concatenates stored block metadata (title, name, alias, anchor text) and client-supplied keywords into a SQL MATCH statement, escaping only double quotes and not single quotes. This runs on the main read-write siyuan.db handle via a driver capable of statement stacking.

What Was Reported

The advisory describes two distinct injection vectors:

• First-order: a client-supplied keyword containing a single quote breaks out of the SQL string literal directly. This is reportedly reachable by an anonymous reader on the publish surface when Publish.Auth.Enable is disabled, or by any authenticated publish RoleReader.
• Second-order: a document title, name, alias, or anchor text containing a single quote is stored safely (indexing uses parameterized inserts) but detonates later when that stored value is concatenated — unescaped — into a subsequent backlink query, including on a different user's kernel that has ingested the malicious document (e.g., via sync, import, or a shared .sy.zip).

The advisory states routes such as getBacklink, getBacklink2, getBacklinkDoc, and getBackmentionDoc are gated only by CheckAuth. Per the report, the reachable ceiling is arbitrary cross-notebook SQL read and, via statement stacking, write. The advisory notes encrypted notebooks are out of scope and that code execution is not reachable in the default build (no load_extension). It also states this is a distinct sink from other previously reported SQL findings in searchDocs, searchEmbedBlock, and getEmbedBlock — a fix to those does not remediate this path. Verification per the report was limited to non-destructive syntax-error probing and observing stored-value behavior; no exfiltration or write statement was executed.

Why It Matters for Defenders

This affects any organization running self-hosted SiYuan (github.com/siyuan-note/siyuan/kernel) with publish mode enabled. The first-order vector is notable because it may not require authentication at all when publish auth is disabled, lowering the bar to remote exploitation to a single crafted request. The second-order vector broadens the blast radius beyond direct network exposure: a malicious document shared, synced, or imported into a workspace can trigger the same injection on a victim's kernel later, making content-supply-chain style delivery (shared notebooks, imported .sy files) a viable attack path independent of network reachability.

What Defenders Should Watch For / Do Now

• Identify any SiYuan instances exposed via publish mode, especially those with Publish.Auth.Enable set to false, and restrict or disable anonymous publish access until patched.
• Treat imported or synced .sy/.sy.zip content from untrusted sources as a delivery vector for stored-content injection; review provenance of shared notebooks before ingesting them.
• At a high level, hunt for anomalous backlink/mention API calls (getBacklink, getBacklink2, getBacklinkDoc, getBackmentionDoc) containing single-quote characters or SQL syntax fragments in the keyword parameter, and for SQLite errors or unusual query latency around these endpoints in kernel logs.
• Watch vendor channels for a patch; per the advisory, the underlying fix requires parameterizing (or consistently escaping) both the client keyword and stored metadata at the query-construction site in backlink.go, since safe storage alone does not prevent the reuse-time injection.

This is developing, net-new intelligence based on a single advisory published 2026-09-03; details may be refined as the vendor responds and a patch is released. For full technical detail, see the original GitHub Security Advisory: GHSA-q2vg-7qgx-x5fc.