SiYuan versions up to and including v3.7.2 contain a critical SQL injection vulnerability in the /api/search/searchEmbedBlock endpoint. The endpoint passes client-supplied SQL statements directly to the main read-write siyuan.db database handle without any sanitization, single-statement enforcement, read-only restrictions, or admin-level access controls. Authentication is only gated by CheckAuth, meaning the vulnerability is exploitable by users holding a publish RoleReader token, or by anonymous users when publish authentication is disabled. The underlying SQLite driver supports stacked statements, allowing attackers to both read and modify content across all open cleartext notebooks. Encrypted per-box notebooks are not affected. The vulnerability was fixed in SiYuan v3.7.3.