CVE-2026-93591 SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGrap...