CVE-2026-93922
8.8 HIGHpublic exploit availablePublished 2026-09-19 · Updated 2026-09-22
AI risk analysis
- Summary
- This flaw allows attackers to inject HTML payloads into notebook names, which can execute JavaScript with Node.js access when the Daily Note picker dialog opens, leading to potential operating system command execution.
- Exploitability
- Exploitation is relatively straightforward as attackers can create notebooks with malicious names, and the flaw is present in the Electron renderer.
- Blast radius
- If exploited, this could lead to full system compromise, as the attack can execute arbitrary JavaScript and potentially command execution.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to SiYuan 3.8.5 or later.
rcewebxssos-commands
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Public exploit & PoC references
- https://github.com/siyuan-note/siyuan
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/mount.ts#L72
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/file.go#L2446-L2454
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm
All references
- https://github.com/siyuan-note/siyuan
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/mount.ts#L72
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/file.go#L2446-L2454
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm
- https://www.vulncheck.com/advisories/siyuan-through-3.8.4-stored-xss-via-notebook-names
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2025-53837PoC
- MEDIUMCVE-2025-71419PoC
- HIGHCVE-2026-100639PoC
- HIGHCVE-2026-16143
- CRITICALCVE-2026-18872
- MEDIUMCVE-2026-36468PoC
- MEDIUMCVE-2026-46650PoC
- HIGHCVE-2026-55105PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.