# CVE-2026-69084: SiYuan - SQLi

> Live exploitation tracking for CVE-2026-69084 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-69084

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.9
- **Public exploit available:** Yes
- **Affected products:** SiYuan
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** web_application

## Description

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

## CrowdSec analysis

[CVE-2026-69084](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-69084) is a critical SQL injection vulnerability in SiYuan versions through 3.7.2, affecting the `/api/search/searchEmbedBlock` endpoint. Because attacker-controlled SQL is executed without adequate restrictions, unauthenticated or low-privileged users can run stacked statements to read and modify content across opened cleartext notebooks, potentially compromising sensitive data and application integrity remotely. The issue is fixed in SiYuan 3.7.3.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-69084 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/api/search/searchEmbedBlock` with crafted SQL in the `stmt` JSON field, typically after authenticating through `/api/system/loginAuth`. The endpoint may allow unauthorized or low-privilege users to execute arbitrary SQL against SiYuan’s database and read or modify notebook content.

## Timeline

- 2026-08-03: CVE Published. CVE-2026-69084 is published to NVD.
- 2026-08-25: Rule Released. CrowdSec releases a rule to detect CVE-2026-69084 exploitation attempts against the CrowdSec Network.
- 2026-08-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-69084 for the first time.

## References

- https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-69084.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-69084) follows observed exploitation activity for CVE-2026-69084. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.