CVE-2026-100634
Deferred Deferred - Pending Action

SiYuan IPC Handler Lockscreen Denial of Service

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: "lockscreenByMode"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100634
EUVD
EUVD-2026-87728

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.8.4 has a missing authorization flaw in its Electron main process IPC handler called 'siyuan-send-windows'. This handler fails to validate the sender and forwards messages to all BrowserWindows, including those in other workspaces. An attacker can send a {cmd: 'lockscreenByMode'} message, which triggers a lockscreen action in another workspace if its lockScreenMode is set to 1. This causes repeated locking of unrelated windows, leading to a limited denial of service without affecting confidentiality, integrity, or code execution.

Detection Guidance

This vulnerability can be detected by checking the SiYuan version installed on your system. If the version is below 3.8.4, the system is vulnerable. Run the following command to check the version: siyuan --version. Additionally, monitor network traffic for unexpected IPC messages between SiYuan windows or workspaces.

Impact Analysis

This vulnerability allows an attacker-controlled remote kernel to disrupt your SiYuan workspace by repeatedly locking your windows. This causes a limited denial of service, making it difficult to use the application until the issue is resolved or the attacker stops sending messages.

Mitigation Strategies

Immediately update SiYuan to version 3.8.4 or later to patch the vulnerability. If updating is not possible, restrict network access to SiYuan instances and avoid opening untrusted workspaces. Disable IPC message forwarding between workspaces if supported by the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100634. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart