CVE-2026-93923: SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users who open a crafted notebook are exposed because malicious heading style values can be stored and later rendered in the outline or bookmark dock. Administrative endpoints can also be used to inject the malicious values.
What does an attacker need to exploit this issue?
An attacker needs to get crafted heading style values into a notebook or access administrative endpoints that accept those values. Victim interaction is required for the malicious content to execute in the Electron renderer.
What is the impact if exploitation succeeds?
The stored script executes in the Electron renderer with full system access. This can affect confidentiality, integrity, and availability.