CVE-2026-92986— SiYuan before 3.8.4 Cross-Site Scripting via Document Title
Quick assessment
Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SiYuan 3.8.4 之前的版本存在一个安全漏洞：在反向链接面板的树形视图中，文档标题会被直接作为 HTML 渲染，且未对标记字符进行转义。攻击者可以通过重命名 API 或精心构造的笔记本设置恶意标题，从而在 Electron 渲染进程中执行脚本。由于该渲染进程拥有对 模块的访问权限，最终可实现命令执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92986
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before 3.8.4 Cross-Site Scripting via Document Title
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.8.4 | - |
|
II. Public POCs for CVE-2026-92986
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92986
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-92986 (2)
-
🔗 siyuan/app/src/util/Tree.ts at v3.8.3 · siyuan-note/siyuan · GitHub Read full article technical-description
-
Vendor Advisories for CVE-2026-92986 (2)
Proof of Concept for CVE-2026-92986 (1)
IV. Related Vulnerabilities
Same product: siyuan
-
CVE-2026-92985
SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels -
CVE-2026-87815
SiYuan before v3.8.2 Path Traversal via removeRiffDeck -
CVE-2026-87814
SiYuan before v3.8.2 Stored XSS via Asset Preview -
CVE-2026-87813
SiYuan before v3.8.2 Stored XSS via unescaped asset filename -
CVE-2026-87811
SiYuan before v3.8.2 Stored XSS via notebook template paths
Same vendor: siyuan-note
-
CVE-2026-92985
SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels -
CVE-2026-87815
SiYuan before v3.8.2 Path Traversal via removeRiffDeck -
CVE-2026-87814
SiYuan before v3.8.2 Stored XSS via Asset Preview -
CVE-2026-87813
SiYuan before v3.8.2 Stored XSS via unescaped asset filename -
CVE-2026-87811
SiYuan before v3.8.2 Stored XSS via notebook template paths
Same weakness: CWE-79
-
CVE-2026-93296
MISP Overmind: Stored Cross-Site Scripting via Unescaped Obj -
CVE-2026-63459
Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-s -
CVE-2026-92985
SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels -
CVE-2026-92973
ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC -
CVE-2026-90887
WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site
V. Comments for CVE-2026-92986
No comments yet