{"action":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260723004839-1a5b3431d5ab or later.","affected":[{"introduced":"0"}],"component":"github.com/siyuan-note/siyuan/kernel","cve_ids":["CVE-2026-72811"],"ecosystem":"Go","epss":0.00436,"exploited":false,"fixed_versions":["0.0.0-20260723004839-1a5b3431d5ab"],"ghsa_id":"GHSA-q2vg-7qgx-x5fc","id":"tcs_01M5KFJ5VJJ8Y6T87EPHGJBHTT","modified_at":"2026-09-10T15:25:26.236198352Z","published_at":"2026-09-03T22:27:50Z","references":["https://osv.dev/vulnerability/GHSA-q2vg-7qgx-x5fc","https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc","https://nvd.nist.gov/vuln/detail/CVE-2026-72811","https://github.com/siyuan-note/siyuan/commit/1a5b3431d5ab3036b19c1cc79486fedd6906fb57","https://github.com/siyuan-note/siyuan","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-q2vg-7qgx-x5fc","url":"https://osv.dev/vulnerability/GHSA-q2vg-7qgx-x5fc"}],"summary":"SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write hand"}