CVE-2026-92985

Summary

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.

Affected Software

Weaknesses

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jhfc-9mcq-8p8v

References

• https://github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7
• https://github.com/siyuan-note/siyuan
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jhfc-9mcq-8p8v
• https://github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.ts#L134
• https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-bookmark-labels

• ←Previous
• Next→