CVE-2026-92986

Summary

The flaw allows attackers to inject malicious HTML into document titles, leading to potential script execution in the Electron renderer with access to child_process for command execution.

Exploitability

Exploitation is moderately hard as it requires attackers to set malicious titles through the rename API or crafted notebooks, but preconditions include having access to the affected feature.

Blast radius

If exploited, the impact could be significant, allowing attackers to execute arbitrary commands and potentially gain full control over the system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to SiYuan 3.8.4 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.