Is CVE-2026-101091 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-101091?

CVE-2026-101091 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-101091

Description

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.