CVE-2026-100634: SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows
SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: "lockscreenByMode"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SiYuan versions before v3.8.4 are affected. Exploitation requires multiple workspace windows: an attacker-controlled remote-kernel workspace and another local workspace window with lockScreenMode set to 1.
What does an attacker need to do to trigger the impact?
A renderer connected to an attacker-controlled remote kernel must send an IPC payload with cmd set to "lockscreenByMode". The vulnerable handler forwards that payload to all BrowserWindow instances rather than limiting it to the sender's workspace.
What is the practical impact?
An attacker can repeatedly lock unrelated local workspace windows, causing a limited denial of service. The provided information reports no confidentiality, integrity, or code-execution impact.
How can I tell whether I may be affected?
Check whether SiYuan is earlier than v3.8.4 and whether users can open a workspace connected to an attacker-controlled remote kernel alongside other workspace windows. The lock-screen effect specifically requires a target sibling workspace with lockScreenMode set to 1.