CVE-2026-100641

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4

Description Stored flashcard block content is not HTML-escaped before being interpolated into the card-manager list markup. Content returned by the '/api/riff/getRiffCards' endpoint is inserted into a template in 'app/src/card/viewCards.ts' and assigned to listElement.innerHTML, allowing executable event-handler attributes to be injected. Due to the desktop application being configured with nodeIntegration enabled and contextIsolation disabled, an administrator opening a workspace with malicious flashcard content can trigger arbitrary code execution on the host system via a privileged renderer.

Recommendations Update to version 3.8.4 or later.