CVE-2026-92985

HIGH 8.8

SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.

CWE	CWE-79
Vendor	siyuan-note
Product	siyuan
Published	Sep 17, 2026
Last Updated	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for siyuan-note siyuan

Be the first to know when new high vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

siyuan-note / siyuan

0 < 3.8.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7 github.com: https://github.com/siyuan-note/siyuan github.com: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jhfc-9mcq-8p8v github.com: https://github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.ts#L134 vulncheck.com: https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-bookmark-labels

Credits

EVIL0RD