CVE-2026-86712

Deferred Deferred - Pending Action

SiYuan Desktop Clipboard Code Execution via MIME Type

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86712

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SiYuan before version 3.8.2 has a vulnerability where it trusts the clipboard MIME type 'text/siyuan' set by an attacker. This allows malicious scripts to bypass sanitization when pasted into the application. The vulnerability exists in the paste handler of the Node-enabled desktop renderer, enabling code execution with full Node.js privileges through the Electron main process.

Detection Guidance

Detecting this vulnerability requires checking the installed version of SiYuan. If you are running a version prior to 3.8.2, the system is vulnerable. No specific commands are provided in the context to detect active exploitation.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system if you paste content from a malicious web page into SiYuan. Since the injected scripts run with full Node.js access, attackers could steal data, install malware, or take control of your computer. It primarily affects users of the SiYuan desktop application.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using SiYuan may face compliance violations if sensitive data is compromised due to this flaw, potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Immediately update SiYuan to version 3.8.2 or later to address the vulnerability. Avoid pasting content from untrusted sources into SiYuan until the update is applied.

Hi! I’m here to help you understand CVE-2026-86712. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70