CVE-2026-92986

HIGH 8.8

SiYuan before 3.8.4 Cross-Site Scripting via Document Title

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.

CWE	CWE-79
Vendor	siyuan-note
Product	siyuan
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for siyuan-note siyuan

Be the first to know when new high vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

siyuan-note / siyuan

0 < 3.8.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7 github.com: https://github.com/siyuan-note/siyuan github.com: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c5h9-g2c6-fxjw github.com: https://github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.ts#L134 vulncheck.com: https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-document-title

Credits

EVIL0RD