High severity · published Sep 17, 2026
CVE-2026-92986
SiYuan before 3.8.4 Cross-Site Scripting via Document Title
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92986
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92986
github.com
https://github.com/siyuan-note/siyuan
github.com
https://github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.ts#L134
github.com
https://github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c5h9-g2c6-fxjw
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-document-title
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP