Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100634SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

Medium 4.7

In plain English

A medium-severity missing authorization in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.6%top 53.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: "lockscreenByMode"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.8.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-wxp7-xpq8-8xpm) vendor-advisory
Patch Commit patch
VulnCheck Advisory: SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows third-party-advisory