High severity · published Sep 17, 2026
CVE-2026-92985
SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92985
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92985
github.com
https://github.com/siyuan-note/siyuan
github.com
https://github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.ts#L134
github.com
https://github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jhfc-9mcq-8p8v
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-bookmark-labels
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP