CVE-2026-92985: SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for command execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4 - Compensating control
Mitigate by blocking opening/importing untrusted .sy notebook files until SiYuan is upgraded to 3.8.4, since crafted notebook files can inject scripts in the Electron renderer via bookmark labels.
Event History
Frequently Asked Questions
Which installations are affected?
SiYuan versions before 3.8.4 are affected. Installations running 3.8.4 or later are not identified as affected by the provided information.
What attacker interaction is required for exploitation?
An attacker must provide a crafted .sy notebook file containing malicious HTML in bookmark attributes, and the target must import that notebook file. The vulnerability has user interaction required.
What is the practical impact after successful exploitation?
The malicious bookmark label can execute script in the Electron renderer. The renderer has access to child_process, allowing command execution.