Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck
CVE-2026-93923SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
High 8.8
In plain English
A high-severity cross-site scripting in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 51.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | 0 – through 3.8.4 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-928g-4hfq-qwvx) vendor-advisory
- https://github.com/siyuan-note/siyuan product
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/render.go#L71-L76 technical-description
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/Tree.ts#L133 technical-description
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/Tree.ts#L194 technical-description
- VulnCheck Advisory: SiYuan through 3.8.4 Stored XSS via Heading Style Attribute third-party-advisory