High severity8.8NVD Advisory· Published Sep 17, 2026· Updated Sep 17, 2026
CVE-2026-92986
CVE-2026-92986
Description
SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.8.4
Patches
Vulnerability mechanics
References
4- github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.tsnvd
- github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7nvd
- github.com/siyuan-note/siyuan/security/advisories/GHSA-c5h9-g2c6-fxjwnvd
- www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-document-titlenvd
News mentions
0No linked articles in our index yet.