CVE-2026-92985: stored XSS — HIGH

CISO Take

SiYuan, a local-first note-taking and knowledge management tool, fails to escape bookmark labels from imported .sy notebook files before rendering them in the dock tree, so crafted HTML runs as script inside the Electron renderer, which can reach child_process and execute OS commands (fixed in 3.8.4). The CVSS is 8.8 and the attack is network-delivered, low complexity, and needs no privileges, but it requires the user to import a malicious notebook. Exploitation likelihood is modest today: EPSS is 0.8% (top 44%), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC rates it ATTEND, meaning it deserves attention but is not an emergency. The risk is higher for teams that keep AI research notes, prompts, API keys and model credentials in SiYuan, since a compromised endpoint exposes those secrets. Upgrade all SiYuan desktop installs to 3.8.4 or later, and tell users not to import notebooks from untrusted sources until they have.

Sources:NVDEPSSGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium-high. CVSS 8.8 reflects full confidentiality, integrity and availability impact on the user's workstation. Exploitation is easy once a victim imports a crafted .sy file, because the payload is plain unescaped HTML in a bookmark attribute (CWE-79). User interaction is required, and no exploitation in the wild, public PoC, KEV listing or scanner template has been observed. EPSS is low (0.00816, 44th percentile) and SSVC says ATTEND. Exposure is limited to endpoints running SiYuan versions before 3.8.4. Dependents, scorecard and package risk data are unavailable, so the blast radius is hard to quantify.

How does the attack unfold?

Initial Access

Attacker delivers a crafted .sy notebook with unescaped HTML in a bookmark label to the victim.

AML.T0011.003

Execution

The victim imports the notebook and the dock tree renders the bookmark, executing the script in the Electron renderer.

Command Execution

The script uses child_process to run arbitrary OS commands as the user.

AML.T0050

Impact

Attacker steals AI API keys, credentials and research data, and gains a foothold on the workstation.

Initial Access

Attacker delivers a crafted .sy notebook with unescaped HTML in a bookmark label to the victim.

AML.T0011.003

Execution

The victim imports the notebook and the dock tree renders the bookmark, executing the script in the Electron renderer.

Command Execution

The script uses child_process to run arbitrary OS commands as the user.

AML.T0050

Impact

Attacker steals AI API keys, credentials and research data, and gains a foothold on the workstation.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 57% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade SiYuan to 3.8.4 or later (fix commit 6f093ebe). 2) Until patched, do not import .sy notebooks or shared workspaces from untrusted or unverified sources. 3) Inventory SiYuan installs on developer and research endpoints through EDR or software inventory. 4) Detect child processes spawned by the SiYuan Electron process (for example shells, curl, powershell) via EDR rules. 5) Rotate API keys and tokens stored in notes if a malicious import is suspected. 6) Restrict sharing of notebook files through email or chat from external parties.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSocial EngineeringFrameworkAML.T0011.003- Malicious Link AML.T0050- Command and Scripting Interpreter AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage identified ones

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-92985?

SiYuan, a local-first note-taking and knowledge management tool, fails to escape bookmark labels from imported .sy notebook files before rendering them in the dock tree, so crafted HTML runs as script inside the Electron renderer, which can reach child_process and execute OS commands (fixed in 3.8.4). The CVSS is 8.8 and the attack is network-delivered, low complexity, and needs no privileges, but it requires the user to import a malicious notebook. Exploitation likelihood is modest today: EPSS is 0.8% (top 44%), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC rates it ATTEND, meaning it deserves attention but is not an emergency. The risk is higher for teams that keep AI research notes, prompts, API keys and model credentials in SiYuan, since a compromised endpoint exposes those secrets. Upgrade all SiYuan desktop installs to 3.8.4 or later, and tell users not to import notebooks from untrusted sources until they have.

Is CVE-2026-92985 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-92985, increasing the risk of exploitation.

How to fix CVE-2026-92985?

1) Upgrade SiYuan to 3.8.4 or later (fix commit 6f093ebe). 2) Until patched, do not import .sy notebooks or shared workspaces from untrusted or unverified sources. 3) Inventory SiYuan installs on developer and research endpoints through EDR or software inventory. 4) Detect child processes spawned by the SiYuan Electron process (for example shells, curl, powershell) via EDR rules. 5) Rotate API keys and tokens stored in notes if a malicious import is suspected. 6) Restrict sharing of notebook files through email or chat from external parties.

What systems are affected by CVE-2026-92985?

This vulnerability affects the following AI/ML architecture patterns: Developer workstations, Knowledge management tools, AI research note-taking environments.

What is the CVSS score for CVE-2026-92985?

CVE-2026-92985 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.82%.

What is the AI security impact?

Affected AI Architectures

Developer workstationsKnowledge management toolsAI research note-taking environments

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0050Command and Scripting Interpreter

AML.T0112Machine Compromise

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.

Exploitation Scenario

An attacker sends a researcher or ML engineer a notebook export, for example 'LLM red-team notes.sy', via email, a shared drive, or a community forum. The .sy file contains a bookmark label with embedded HTML such as an onerror handler. When the victim imports the notebook, the dock tree renders the bookmark unescaped and the script runs in the Electron renderer. The script uses child_process to launch a payload that steals API keys, cloud credentials and source code from the machine, then establishes persistent access to internal AI development resources.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.