CVE-2026-93922

Deferred Deferred - Pending Action

Stored XSS in SiYuan Notebook Names via Daily Note Picker

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93922

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SiYuan through 3.8.4 has a stored cross-site scripting vulnerability in the Daily Note picker dialog. Notebook names are rendered as raw HTML without proper escaping, allowing attackers to inject malicious scripts. When the picker dialog opens, the injected JavaScript executes with Node.js privileges, potentially enabling full operating system command execution.

Detection Guidance

To detect this vulnerability, inspect SiYuan notebook names for HTML or JavaScript payloads. Check for notebooks with names containing <script>, onload, or other HTML/JS event handlers. Manually review the Daily Note picker dialog in SiYuan for rendered HTML content.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system if you use SiYuan 3.8.4 or earlier. By tricking you into opening the Daily Note picker, malicious notebook names could run commands that steal data, install malware, or take control of your computer. It poses a high risk due to the combination of stored XSS and Node.js access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using SiYuan may face compliance breaches if attackers exploit this to access sensitive data.

Mitigation Strategies

Immediately update SiYuan to the latest version beyond 3.8.4. Avoid opening untrusted notebooks or picker dialogs. Disable JavaScript in SiYuan if possible. Monitor for unusual activity or unauthorized commands on your system.

Hi! I’m here to help you understand CVE-2026-93922. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70