{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-69085",
    "url": "https://cveboard.org/i/cve-2026-69085",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-69085",
    "json": "https://cveboard.org/i/cve-2026-69085.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking",
    "summary": "The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when Publish.Auth.Enable is false.",
    "titlePt": "SiYuan: Injeção de SQL não autenticada em searchDocs via palavra-chave não escapada (modo de publicação): leitura/escrita entre cadernos com empilhamento de instruções",
    "summaryPt": "O endpoint /api/filetree/searchDocs concatena a palavra-chave de busca fornecida pelo chamador diretamente em uma instrução SQL sem escape e sem vinculação de parâmetros. O endpoint é protegido por CheckAuth, acessível apenas pelo token RoleReader de publicação, e pela conta anônima quando Publish.Auth.Enable é falso.",
    "cves": [
      "CVE-2026-69085"
    ],
    "ghsa": "GHSA-33jq-p8c2-q3q4",
    "cvss": {
      "score": 10,
      "version": "3.1"
    },
    "epss": {
      "percentage": 0.01488,
      "percentile": 0.73546,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "go",
        "name": "github.com/siyuan-note/siyuan/kernel",
        "vulnerable": "< 0.0.0-20260721043339-eef10568384e",
        "fixed": "0.0.0-20260721043339-eef10568384e",
        "advisory": "GHSA-33jq-p8c2-q3q4"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-33jq-p8c2-q3q4"
      }
    ],
    "publishedAt": "2026-10-01T14:38:48.000Z",
    "updatedAt": "2026-10-01T14:38:48.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-33jq-p8c2-q3q4:ghsa_published:2026-10-01T14:38:48.000Z",
      "incidentId": "cve-2026-69085",
      "type": "ghsa_published",
      "at": "2026-10-01T14:38:48.000Z",
      "detail": {
        "ghsa": "GHSA-33jq-p8c2-q3q4",
        "severity": "critical",
        "fixed": "0.0.0-20260721043339-eef10568384e"
      }
    }
  ]
}