Siyuan Before 3.8.2 Remote Code Execution Via Clipboard

Back www.vulncheck.com

Siyuan Before 3.8.2 Remote Code Execution Via Clipboard

www.vulncheck.com • September 8, 2026

Share: View original

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

GitHub Security Advisory (GHSA-9rr9-pxr4-gcgc)

SiYuan v3.8.2 Release Notes

Lute.Sanitize runs only in the if (!siyuanHTML) branch, v3.8.1

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-86712 Vulnerability in SiYuan Note Exposes Users to Code Execution Risks A high-risk vulnerability, CVE-2026-86712, has been identified in SiYuan Note versions prior to 3.8.2. The flaw allows attackers to exploit the application by leveraging an attacker-writable clipboard MIME type, enabling code execution through the Electron main process. Users are at risk, particularly those handling sensitive information, as successful exploitation can lead to unauthorized access to confidential notes and files. The vulnerability requires user interaction to exploit, specifically through pasting malicious content. It has been classified with a CVSS score of 8.6, indicating a high severity level. Immediate remediation is advised, including upgrading to the patched version and restricting untrusted browsing. The vulnerability was published on September 8, 2026, and no active exploitation has been confirmed yet. 4 sources 65

Extracted Entities

Attack Types (2)

Cross-site Scripting Remote Code Execution

CWE Weaknesses (1)

CWE-79 - Cross-site Scripting (xss)