CVE-2026-100634

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4

Description The Electron main process in app/electron/main.js fails to validate the sender or restrict recipients within the 'siyuan-send-windows' IPC handler. The handler ignores the event.sender and forwards any received payload to all windows returned by BrowserWindow.getAllWindows(), including those from different opened workspaces. An attacker-controlled remote kernel can send a payload with the cmd variable set to "lockscreenByMode", which triggers the lockScreen() function in sibling workspace windows where lockScreenMode is set to 1. This can be used to repeatedly lock unrelated local workspace windows, resulting in a limited denial of service.

Recommendations Update SiYuan to version 3.8.4 or later.