CVE-2026-86712 | BDVDB-2026-370451 Detail
siyuan-notesiyuan
Description#
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References#
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9rr9-pxr4-gcgc
- https://github.com/siyuan-note/siyuan/commit/9ce660652de2ced26ec2d98a5a242cb0b8bb7273
- https://github.com/siyuan-note/siyuan/releases/tag/v3.8.2
- https://github.com/siyuan-note/siyuan/blob/v3.8.1/app/src/protyle/util/paste.ts
- https://github.com/siyuan-note/siyuan
- https://www.vulncheck.com/advisories/siyuan-before-3.8.2-remote-code-execution-via-clipboard
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.