CVE-2026-92985
High
Description
SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.
SeverityHigh
CVSS8.8
Exploit probability—
ProductSiyuan
PublishedSep 17, 2026
First seenSep 17, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- siyuan-note siyuan3.8.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siyuan-note siyuan | v < 3.8.4 | 3.8.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.