CVE-2026-86712 SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

CVE-2026-86712 SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

CVE-2026-86712

SiYuan before 3.8.2 is an Electron-based note-taking application vulnerable to Remote Code Execution via its clipboard paste handler. The root cause is that SiYuan trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler (app/src/protyle/util/paste....

CVE-2026-86712 SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

EUVD-2026-72687

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

CVE-2026-86711

electerm versions before 5.3.15 are affected by an arbitrary command execution vulnerability in the runGlobalAsync Electron IPC handler (src/app/lib/ipc.js). The handler exposes over 40 main-process functions without a function-name allowlist or sender validation, allowing renderer-side script ex...

CVE-2026-86712: Improper Neutralization of Input During Web Page Generation

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

CVE-2026-86711: Exposed Dangerous Method or Function

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

PT-2026-87037

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

PT-2026-87038

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

swagger-koa88 (>=1.0.2, <=1.0.5-0), windows10-electron-vibrancy (>=1.0.0, <=1.0.1) +1 more potentially affected by unknown CVE via coffe-script (0.0.1-security)

coffe-script NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on coffe-script and may be impacted: - swagger-koa88 =1.0.2, =1.0.0, =1.0.5, =1.1.3 Source cves: unknown CVE Source advisory: GHSA-2WWV-4GRX-MW7C...

Malicious Package

Overview eigenstate-electron-lithosphere-dagda is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

CVE-2026-85107

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107 NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107 NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107

A vulnerability in NousResearch hermes-agent 0.18.0 affects the resourceBufferFromUrl function in apps/desktop/electron/main.ts (Electron Main Process), allowing a remote attacker with user interaction to trigger uncontrolled resource allocation, resulting in low availability impact. Notably, the...

EUVD-2026-70454

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...