CVE-2026-93922

EUVD-2026-83458
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 44.57%
Common Weakness Enumeration
References
https://github.com/siyuan-note/siyuan
https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/mount.ts#L72
https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/file.go#L2446-L2454
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm
https://www.vulncheck.com/advisories/siyuan-through-3.8.4-stored-xss-via-notebook-names