High severity8.8NVD Advisory· Published Sep 17, 2026· Updated Sep 17, 2026
CVE-2026-92985
CVE-2026-92985
Description
SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.8.4
Patches
Vulnerability mechanics
References
4- github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.tsnvd
- github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7nvd
- github.com/siyuan-note/siyuan/security/advisories/GHSA-jhfc-9mcq-8p8vnvd
- www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-bookmark-labelsnvd
News mentions
0No linked articles in our index yet.