{"id":"CVE-2026-92986","published":"2026-09-17T15:17:02.033","lastModified":"2026-09-17T20:18:59.970","description":"SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/siyuan-note/siyuan","tags":[]},{"url":"https://github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.ts#L134","tags":[]},{"url":"https://github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7","tags":[]},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c5h9-g2c6-fxjw","tags":[]},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-document-title","tags":[]}],"exploitRefs":[{"url":"https://github.com/siyuan-note/siyuan","tags":[]},{"url":"https://github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.ts#L134","tags":[]},{"url":"https://github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7","tags":[]},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c5h9-g2c6-fxjw","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to inject malicious HTML into document titles, leading to potential script execution in the Electron renderer with access to child_process for command execution.","exploitability":"Exploitation is moderately hard as it requires attackers to set malicious titles through the rename API or crafted notebooks, but preconditions include having access to the affected feature.","blast_radius":"If exploited, the impact could be significant, allowing attackers to execute arbitrary commands and potentially gain full control over the system.","remediation":"Upgrade to SiYuan 3.8.4 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","api","renderer"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:09:10.088Z"}}