CVE-2026-100640: SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of SiYuan versions before v3.8.4 are exposed when attacker-controlled remote renderer content is involved and the user performs a paste operation. The disclosed data can include MathML formulas, Office clipboard bytes, and WPS clipboard bytes.
What does an attacker need to exploit it?
An attacker needs control over remote renderer content and must invoke the affected IPC commands with matching plaintext. Exploitation also requires user interaction through a paste operation.
Is sensitive clipboard content exposed automatically?
The available information describes disclosure during user-mediated paste operations, rather than automatic background clipboard access. The affected handler permits access to native clipboard formats through the specified IPC commands.
What version should be used to remediate the issue?
Upgrade SiYuan to v3.8.4 or later. Versions before v3.8.4 are identified as affected.