HIGH

CVE-2026-93922

2026-09-19 CVSS v3.1

CVSS

8.8

Description

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

References

https://github.com/siyuan-note/siyuan https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/mount.ts#L72 https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/file.go#L2446-L2454 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm https://www.vulncheck.com/advisories/siyuan-through-3.8.4-stored-xss-via-notebook-names

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE