CVE-2026-100634

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634

SiYuan versions before v3.8.4 are vulnerable to a flaw in the 'siyuan-send-windows' IPC handler within the Electron main process (app/electron/main.js). The handler fails to validate the sender or restrict recipients, forwarding payloads to every BrowserWindow via BrowserWindow.getAllWindows(), i...

PT-2026-99305

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description The Electron main process in app/electron/main.js fails to validate the sender or restrict recipients within the 'siyuan-send-windows' IPC handler. The handler ignores the event.sender and forwards an...