CVE-2026-72807 is a second-order SQL injection vulnerability in SiYuan's attribute-view template column feature. The attack works like this: an attacker crafts a document containing a malicious template column that executes arbitrary SQL when rendered. When this document is distributed to a victim through package sharing or shared notebooks, the victim's SiYuan kernel processes the template in the same trust context as locally-authored templates, executing the injected SQL with kernel-level database access. This is not a classic first-order injection where the attacker directly controls query parameters — the payload is stored, then executed in a different trust context when the document is opened, which is the defining characteristic of second-order injection.
The root cause is a trust boundary collapse. The template column feature was designed for power users extending SiYuan's functionality locally, with an implicit assumption that template authors are trusted. The development team appears to have treated the SQL access in templates as an acceptable ergonomic tradeoff — parameterized queries are rigid and don't support the dynamic template behavior users expect. However, the document distribution mechanism violates this trust assumption by allowing templates authored by third parties to reach the same execution context. The feature that shipped as a local extensibility tool becomes an attack vector once content is shared.
What makes this particularly dangerous is the persistence and blast radius. The malicious template re-executes every time the document is rendered, meaning a single poisoned document forwarded through trusted channels compromises every downstream recipient. Users who believe they've avoided risk by not opening documents from strangers will still be compromised by colleagues who unknowingly forward a tainted document. One document import can yield kernel-wide SQL access.
The patch addresses this specific vector, but the underlying architectural question is whether SiYuan's template system has a coherent threat model for distributed documents. Template columns that can execute raw SQL should either be sandboxed from untrusted sources or the distribution pipeline should strip/sanitize them. Beyond patching this CVE, you should audit other extensibility features — notebook macros, custom widgets, the API layer — for the same implicit trust pattern. The vulnerability exists because the feature was built for a single-user context and the distribution mechanism was added later without re-evaluating the trust assumptions. That same architectural gap likely exists elsewhere in SiYuan's extensibility layer.