CVE-2026-86712 - OSV

Osv.Dev • September 9, 2026

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.

Git / github.com/siyuan-note/siyuan

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-86712 Vulnerability in SiYuan Note Exposes Users to Code Execution Risks A high-risk vulnerability, CVE-2026-86712, has been identified in SiYuan Note versions prior to 3.8.2. The flaw allows attackers to exploit the application by leveraging an attacker-writable clipboard MIME type, enabling code execution through the Electron main process. Users are at risk, particularly those handling sensitive information, as successful exploitation can lead to unauthorized access to confidential notes and files. The vulnerability requires user interaction to exploit, specifically through pasting malicious content. It has been classified with a CVSS score of 8.6, indicating a high severity level. Immediate remediation is advised, including upgrading to the patched version and restricting untrusted browsing. The vulnerability was published on September 8, 2026, and no active exploitation has been confirmed yet. 5 sources 65

Extracted Entities

CVE-2026-86712 - OSV

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)