EUVD-2026-83459

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93923: Improper Neutralization of Input During Web Page Generation

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93922: Improper Neutralization of Input During Web Page Generation

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

CVE-2026-93923 SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93923 SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93922 SiYuan through 3.8.4 Stored XSS via notebook names

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

PT-2026-95721

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.5 Description Stored cross-site scripting occurs because the software fails to escape heading style attributes when rendering HTML for the outline and bookmark dock. Attackers can inject malicious style values by...

PT-2026-95720

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.5 Description The software renders notebook names as raw HTML in the Daily Note picker dialog without proper escaping. This leads to stored cross-site scripting XSS within the Electron renderer. An attacker can...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

PT-2026-94358

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Improper escaping of bookmark labels imported from notebook files occurs during rendering in the dock tree. This allows attackers to create malicious .sy notebook files containing unescaped HTML withi...

CVE-2026-92985: Improper Neutralization of Input During Web Page Generation

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

PT-2026-94359

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description The software renders document titles as HTML in the backlink dock tree without escaping markup characters. This allows attackers to set malicious titles via the rename API or crafted notebooks to...

CVE-2026-92986: Improper Neutralization of Input During Web Page Generation

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

EUVD-2026-76933

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

CVE-2026-86712 SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

EUVD-2026-72688

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

CVE-2026-86712

SiYuan before 3.8.2 is an Electron-based note-taking application vulnerable to Remote Code Execution via its clipboard paste handler. The root cause is that SiYuan trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler (app/src/protyle/util/paste....

PT-2026-87038

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

obsidian-note-toolbar-PoC

Frontmatter-Driven Arbitrary Code Execution in Note Toolbar vi...

CVE-2026-53579

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...