CVE-2026-93922: SiYuan through 3.8.4 Stored XSS via notebook names
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4 - Compensating control
Treat SiYuan Daily Note picker dialog as untrusted: restrict access to the affected Electron renderer context (e.g., limit who can create notebooks and limit workstation access) until the stored XSS via notebook names is remediated.
Event History
Frequently Asked Questions
What user interaction is required for exploitation?
An attacker must first create a notebook whose name contains an HTML payload. The payload executes when the Daily Note picker dialog is opened.
What level of access can successful exploitation provide?
The stored XSS executes in the Electron renderer with Node.js access. This can enable operating system command execution with the privileges of the affected SiYuan user.
Which versions should be considered affected?
SiYuan through version 3.8.4 is affected. The provided data does not identify a fixed version.