CVE-2026-92985— SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
Quick assessment
Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SiYuan 3.8.4 之前版本在渲染停靠栏（Dock）树形结构时，未能对从笔记本文件导入的书签标签进行适当的 HTML 转义。攻击者可构造包含未转义 HTML 的恶意 .sy 笔记本文件，利用书签属性中的 XSS 漏洞，在具备子进程（child_process）访问权限的 Electron 渲染进程中执行脚本，从而实现命令执行。
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1059.003 · Windows Command Shell T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92985
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.8.4 | - |
|
II. Public POCs for CVE-2026-92985
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92985
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-92985 (2)
-
🔗 siyuan/app/src/util/Tree.ts at v3.8.3 · siyuan-note/siyuan · GitHub Read full article technical-description
-
Vendor Advisories for CVE-2026-92985 (2)
Proof of Concept for CVE-2026-92985 (1)
IV. Related Vulnerabilities
Same product: siyuan
-
CVE-2026-92986
SiYuan before 3.8.4 Cross-Site Scripting via Document Title -
CVE-2026-87815
SiYuan before v3.8.2 Path Traversal via removeRiffDeck -
CVE-2026-87814
SiYuan before v3.8.2 Stored XSS via Asset Preview -
CVE-2026-87813
SiYuan before v3.8.2 Stored XSS via unescaped asset filename -
CVE-2026-87811
SiYuan before v3.8.2 Stored XSS via notebook template paths
Same vendor: siyuan-note
-
CVE-2026-92986
SiYuan before 3.8.4 Cross-Site Scripting via Document Title -
CVE-2026-87815
SiYuan before v3.8.2 Path Traversal via removeRiffDeck -
CVE-2026-87814
SiYuan before v3.8.2 Stored XSS via Asset Preview -
CVE-2026-87813
SiYuan before v3.8.2 Stored XSS via unescaped asset filename -
CVE-2026-87811
SiYuan before v3.8.2 Stored XSS via notebook template paths
Same weakness: CWE-79
-
CVE-2026-93296
MISP Overmind: Stored Cross-Site Scripting via Unescaped Obj -
CVE-2026-63459
Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-s -
CVE-2026-92986
SiYuan before 3.8.4 Cross-Site Scripting via Document Title -
CVE-2026-92973
ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC -
CVE-2026-90887
WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site
V. Comments for CVE-2026-92985
No comments yet