What’s Vulnerable › Vulnerabilities

CVE-2026-93922: SiYuan through 3.8.4 Stored XSS via notebook names

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-19 · updated 2026-09-22
• Weakness: CWE-79

Description

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

Affected products

• siyuan-note siyuan: through 3.8.4

References

• https://github.com/siyuan-note/siyuan
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/mount.ts#L72
• https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/file.go#L2446-L2454
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm
• https://www.vulncheck.com/advisories/siyuan-through-3.8.4-stored-xss-via-notebook-names
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm

Get alerted when CVE-2026-93922 or the next vulnerability affects your stack