PT-2026-95720

CVE-2026-93922

Published

2026-09-18

Updated

2026-09-22

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.5

Description The software renders notebook names as raw HTML in the Daily Note picker dialog without proper escaping. This leads to stored cross-site scripting (XSS) within the Electron renderer. An attacker can create a notebook with a name containing HTML payloads that execute JavaScript with Node.js access when the picker is opened, potentially allowing the execution of operating system commands.

Recommendations Update SiYuan to version 3.8.5 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Evil0Rd

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers