PT-2026-99311 · Siyuan · Siyuan
CVSS v4.0
8.6
عالية
| المتجه | AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.8.4
Description
An authorization omission exists in the
siyuan-get IPC handler. This allows remote-kernel renderers to access native clipboard formats by invoking the clipboardReadMathML(), clipboardReadOffice(), and clipboardReadWPS() commands with matching plaintext. Attackers who control remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from the local clipboard during user-mediated paste operations.Recommendations
Update to version 3.8.4 or later.
استغلال
إصلاح
Information Disclosure
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Siyuan