CVE-2026-92986: SiYuan before 3.8.4 Cross-Site Scripting via Document Title
SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
SiYuan versions before 3.8.4 are affected. The issue is in rendering document titles in the backlink dock tree.
What must an attacker do to exploit this?
An attacker must cause a malicious document title to be processed, either by setting it through the rename API or by providing a crafted notebook. Exploitation also requires user interaction, as reflected by the UI:R vector.
What is the likely impact of successful exploitation?
Malicious title markup can execute scripts in the Electron renderer. The renderer has access to child_process, allowing command execution and resulting in high confidentiality, integrity, and availability impact.