CVE-2026-100640
Deferred Deferred - Pending Action

SiYuan Clipboard Data Exposure via IPC Handler

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100640
EUVD
EUVD-2026-87734

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.8.4 has an authorization omission in its siyuan-get IPC handler that allows remote-kernel renderers to access sensitive clipboard data. Attackers controlling such renderers can invoke specific commands (clipboardReadMathML, clipboardReadOffice, clipboardReadWPS) to retrieve MathML formulas, Office bytes, or WPS bytes from the local clipboard during user paste operations.

Detection Guidance

This vulnerability cannot be directly detected via network scanning or standard system commands as it involves an authorization flaw in the SiYuan application's IPC handler. Monitoring for unusual clipboard access patterns during paste operations may indicate exploitation, but no specific detection commands are provided in the available resources.

Impact Analysis

If you use SiYuan versions before 3.8.4, an attacker could potentially access sensitive data from your clipboard when you paste content. This includes formulas, Office documents, or WPS files that may contain private information like text snippets, formulas, or embedded data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing personal or confidential information through clipboard access. Compliance may be impacted if such data exposure occurs.

Mitigation Strategies
  • Upgrade SiYuan to version 3.8.4 or later to address the authorization omission in the IPC handler.
  • Review and restrict remote renderer access to clipboard commands in SiYuan's configuration or Electron IPC settings.
  • Monitor for updates from SiYuan's official security advisories for additional patches or mitigations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100640. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart