CVE-2026-93923 Details
Description
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.
A stored cross-site scripting vulnerability has been identified in SiYuan versions through 3.8.4. The issue arises because the application fails to properly escape heading style attributes when rendering HTML for the outline and bookmark docks. This flaw allows attackers to inject malicious style values that are executed in the Electron renderer, potentially leading to remote code execution with full system access. Exploitation can occur by importing crafted notebooks or by calling administrative endpoints that inject the malicious styles.
Users can update to SiYuan version 3.8.5, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 19, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-928g-4hfq-qwvx | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/siyuan-note/siyuan | [email protected] | Vendor |
| https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/Tree.ts#L133 | [email protected] | Source CodeVendor |
| https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/Tree.ts#L194 | [email protected] | Source CodeVendor |
| https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/render.go#L71-L76 | [email protected] | Source CodeVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-928g-4hfq-qwvx | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/siyuan-through-3.8.4-stored-xss-via-heading-style-attribute | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= 3.8.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 19, 2026 | New CVE Received | [email protected] |