High severity · published Sep 18, 2026
CVE-2026-93922
SiYuan through 3.8.4 Stored XSS via notebook names
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
through 3.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93922
github.com
https://github.com/siyuan-note/siyuan
github.com
https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/mount.ts#L72
github.com
https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/file.go#L2446-L2454
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8c2m-33v9-vvqm
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-through-3.8.4-stored-xss-via-notebook-names
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP