CVE-2026-86712: SiYuan before 3.8.2 Remote Code Execution via Clipboard
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.2 - Compensating control
Block or disable clipboard write/paste from untrusted web pages/applications when using the SiYuan desktop client to reduce exposure to attacker-writable clipboard content and paste-handler code execution.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of SiYuan versions before 3.8.2 are exposed when they paste attacker-controlled clipboard content into the application. The attack can be delivered through a malicious web page that writes the crafted text/siyuan clipboard MIME content.
Does exploitation require prior access or elevated privileges?
No prior privileges are required. Exploitation requires user interaction: the target must paste the malicious clipboard data into SiYuan.
What is the impact after successful exploitation?
Injected scripts execute in SiYuan's Node-enabled desktop renderer with full Node.js access through the Electron main process. This can affect confidentiality, integrity, and availability.
What version addresses the issue?
SiYuan 3.8.2 addresses the vulnerability. Systems running a version before 3.8.2 should be updated.