Vulnerability Description
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/mount.ts#L72
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/file.go#L2446-L24
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm
- https://www.vulncheck.com/advisories/siyuan-through-3.8.4-stored-xss-via-noteboo
FAQ
What is CVE-2026-93922?
CVE-2026-93922 is a vulnerability with a CVSS score of 8.8 (HIGH). SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks ...
How severe is CVE-2026-93922?
CVE-2026-93922 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93922?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.