Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Fix availableCritical · CVSS 10EPSS 1.5%

Published Oct 1, 2026 · updated Oct 1, 2026

What to do

  1. Upgrade to a fixed version: github.com/siyuan-note/siyuan/kernel 0.0.0-20260721043339-eef10568384e.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/siyuan-note/siyuan/kernel

Vulnerable versions
< 0.0.0-20260721043339-eef10568384e
Fixed in
0.0.0-20260721043339-eef10568384e

Check your project: go list -m all | grep github.com/siyuan-note/siyuan/kernel

Sources

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

← All critical vulnerabilities