CVE-2026-93922

SiYuan through 3.8.4 contains a stored cross-site scripting flaw in the Daily Note picker dialog , where notebook names are rendered as raw HTML without escaping. An attacker can create a notebook whose name contains an HTML/JS payload; when a victim opens the picker, the script executes inside t...