CVE-2026-92986: stored XSS — HIGH

CISO Take

SiYuan, a self-hosted note-taking and personal knowledge tool, renders document titles as unescaped HTML in its backlink dock tree before version 3.8.4. Because the Electron renderer exposes child_process, a malicious title or a crafted notebook that gets opened turns a simple script injection into arbitrary command execution on the user's workstation (CVSS 8.8, network vector, low complexity, no privileges, user interaction required). Near-term exploitation risk is moderate-to-low: EPSS is 0.008 (top 44%), the flaw is not in CISA KEV, and no public exploit or Nuclei template exists, though CISA SSVC rates it TRACK*, meaning it should be monitored closely. Exposure is mainly to endpoints where staff use SiYuan for AI-assisted notes or knowledge bases, particularly where shared or imported notebooks are common. Upgrade to 3.8.4 or later, and until that is done, avoid opening notebooks from untrusted sources and restrict access to the rename API.

Sources:NVDEPSSGitHub AdvisoryVulnCheckATLAS

What is the risk?

High severity by CVSS (8.8), but practical risk is moderate. Exploitation needs low complexity and no privileges, but a victim must open a crafted notebook or view a document whose title was changed via the rename API. EPSS of 0.00816 (top 44%), no KEV listing, no public exploit and no scanner template suggest limited in-the-wild activity today. Impact is full confidentiality, integrity and availability loss on the host, because the Electron renderer can reach child_process. Package-level data (dependents, OpenSSF score) is unavailable, so blast radius cannot be quantified. Treat as elevated for users who sync or share notebooks, or who run SiYuan with the API exposed on a network.

How does the attack unfold?

Initial Access

Attacker delivers a crafted notebook or sets a malicious document title through the rename API.

AML.T0011.003

Exploitation

The victim views the backlink dock tree, which renders the title as unescaped HTML and executes the injected script.

AML.T0049

Execution

The script uses Electron's child_process access to run arbitrary OS commands.

AML.T0050

Impact

Attacker steals credentials, API keys and notes, and gains a foothold on the workstation.

Initial Access

Attacker delivers a crafted notebook or sets a malicious document title through the rename API.

AML.T0011.003

Exploitation

The victim views the backlink dock tree, which renders the title as unescaped HTML and executes the injected script.

AML.T0049

Execution

The script uses Electron's child_process access to run arbitrary OS commands.

AML.T0050

Impact

Attacker steals credentials, API keys and notes, and gains a foothold on the workstation.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 57% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade SiYuan to 3.8.4 or later (fix commit 6f093ebe50afc503e2a8b056164293054f8509e7). 2) Until patched, do not open or import notebooks from untrusted sources and do not follow shared links to unknown workspaces. 3) Restrict network access to the SiYuan kernel API (rename endpoints) and require an access auth code; do not expose it to untrusted networks. 4) Review existing notebooks for document titles containing HTML tags such as <img onerror=...> or <script>. 5) Detect: monitor for child processes spawned by the SiYuan Electron process (shell, curl, powershell, bash) via EDR and for unusual outbound connections from the app. 6) Rotate API keys and credentials stored on any workstation where suspicious titles were found.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSocial EngineeringFrameworkPluginAML.T0011.003- Malicious Link AML.T0050- Command and Scripting Interpreter AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-92986?

SiYuan, a self-hosted note-taking and personal knowledge tool, renders document titles as unescaped HTML in its backlink dock tree before version 3.8.4. Because the Electron renderer exposes child_process, a malicious title or a crafted notebook that gets opened turns a simple script injection into arbitrary command execution on the user's workstation (CVSS 8.8, network vector, low complexity, no privileges, user interaction required). Near-term exploitation risk is moderate-to-low: EPSS is 0.008 (top 44%), the flaw is not in CISA KEV, and no public exploit or Nuclei template exists, though CISA SSVC rates it TRACK*, meaning it should be monitored closely. Exposure is mainly to endpoints where staff use SiYuan for AI-assisted notes or knowledge bases, particularly where shared or imported notebooks are common. Upgrade to 3.8.4 or later, and until that is done, avoid opening notebooks from untrusted sources and restrict access to the rename API.

Is CVE-2026-92986 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-92986, increasing the risk of exploitation.

How to fix CVE-2026-92986?

1) Upgrade SiYuan to 3.8.4 or later (fix commit 6f093ebe50afc503e2a8b056164293054f8509e7). 2) Until patched, do not open or import notebooks from untrusted sources and do not follow shared links to unknown workspaces. 3) Restrict network access to the SiYuan kernel API (rename endpoints) and require an access auth code; do not expose it to untrusted networks. 4) Review existing notebooks for document titles containing HTML tags such as <img onerror=...> or <script>. 5) Detect: monitor for child processes spawned by the SiYuan Electron process (shell, curl, powershell, bash) via EDR and for unusual outbound connections from the app. 6) Rotate API keys and credentials stored on any workstation where suspicious titles were found.

What systems are affected by CVE-2026-92986?

This vulnerability affects the following AI/ML architecture patterns: Desktop AI knowledge management tools, Developer and analyst workstations, Self-hosted note and knowledge base servers.

What is the CVSS score for CVE-2026-92986?

CVE-2026-92986 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.82%.

What is the AI security impact?

Affected AI Architectures

Desktop AI knowledge management toolsDeveloper and analyst workstationsSelf-hosted note and knowledge base servers

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0050Command and Scripting Interpreter

AML.T0112Machine Compromise

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.

Exploitation Scenario

An attacker shares a crafted SiYuan notebook (or a workspace export) with a security or data science team as a 'shared research notes' package. One document title contains an HTML payload such as an image tag with an onerror handler. When the victim opens the notebook and the backlink dock tree renders the title, the script runs in the Electron renderer, calls child_process to launch a shell, and downloads a second-stage payload. The attacker then harvests LLM API keys, cloud credentials and source code from the workstation. Alternatively, an attacker with network access to an exposed SiYuan API calls the rename endpoint to plant the malicious title in an existing document that a user later views.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.