Medium severity4.7NVD Advisory· Published Sep 26, 2026· Updated Oct 8, 2026

CVE-2026-100640

Description

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.8.4

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-mjmm-hgmc-m7qfnvd
www.vulncheck.com/advisories/siyuan-before-3.8.4-clipboard-data-disclosure-via-ipcnvd

News mentions

Siyuan Note: Batch of 14 High/Medium Severity Vulnerabilities Disclosed Together
Vypr Intelligence · Sep 26, 2026

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000