CVE-2026-93922: SiYuan: stored XSS in notebook names enables RCE

HIGHPoC AVAILABLECISA: ATTEND

Published September 18, 2026

CISO Take

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker, so an attacker-supplied notebook name becomes stored cross-site scripting in an Electron renderer that has Node.js access, which turns it directly into operating system command execution. The CVSS is 8.8 (network, low complexity, no privileges, user interaction required). Public PoC code exists and CISA SSVC rates it ATTEND, but EPSS is low at 0.008 (top 44%) and it is not in CISA KEV, so there is no evidence of active exploitation yet. Downstream dependents and a patched version are not listed in the data we hold. Treat it as a high-priority fix for any team using SiYuan as a personal knowledge base or AI-assisted note tool, especially with shared or synced workspaces. Upgrade to a release later than 3.8.4 once the vendor advisory confirms the fixed version (GHSA-8c2m-33v9-vvqm). Until then, do not open the Daily Note picker on workspaces from untrusted sources.

Sources:NVDEPSSGitHub AdvisoryVulnCheckATLAS

What is the risk?

High. Exploitation is low complexity with no privileges, and a public PoC exists. The user interaction needed is only opening the Daily Note picker. Because the Electron renderer exposes Node.js, a successful XSS gives full code execution with the user's privileges and a scope of confidentiality, integrity and availability all rated high. Likelihood is moderate: EPSS is 0.00816 (top 44%), there is no KEV listing and no Nuclei template. Exposure depends on how attacker-controlled notebook names reach a victim (shared workspaces, imported or synced data, or a malicious notebook). Risk is higher on developer and analyst workstations holding API keys, tokens and proprietary notes. The practical population is limited to SiYuan desktop users.

How does the attack unfold?

Initial Access

Attacker plants a notebook with an HTML payload in its name through a shared, synced or imported workspace.

AML.T0011.003

Execution

The victim opens the Daily Note picker and the unescaped name runs as JavaScript in the Electron renderer.

AML.T0011

Command Execution

The script uses Node.js access to spawn operating system commands with the user's privileges.

AML.T0050

Impact

Attacker steals notes, credentials and API tokens and gains a foothold on the workstation.

AML.T0112

Initial Access

Attacker plants a notebook with an HTML payload in its name through a shared, synced or imported workspace.

AML.T0011.003

Execution

The victim opens the Daily Note picker and the unescaped name runs as JavaScript in the Electron renderer.

AML.T0011

Command Execution

The script uses Node.js access to spawn operating system commands with the user's privileges.

AML.T0050

Impact

Attacker steals notes, credentials and API tokens and gains a foothold on the workstation.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
github.com/siyuan-note/siyuan/kernel	—	—	No patch

Do you use github.com/siyuan-note/siyuan/kernel? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 57% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade SiYuan to a version later than 3.8.4 that fixes the escaping in the Daily Note picker, and confirm the exact fixed release in the vendor advisory GHSA-8c2m-33v9-vvqm. 2) Until patched, avoid opening the Daily Note picker, and do not import, sync or open notebooks from untrusted sources. 3) Audit existing notebook names for HTML or script content such as <img onerror>, <script> or <svg onload>. 4) Rotate API keys and tokens stored on workstations where a suspicious notebook was opened. 5) Detect by hunting for child processes spawned by the SiYuan Electron process (shells, curl, powershell) and unexpected outbound connections. 6) Where possible, restrict desktop app execution with EDR and application control policies.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are managed

Frequently Asked Questions

What is CVE-2026-93922?

Is CVE-2026-93922 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-93922, increasing the risk of exploitation.

How to fix CVE-2026-93922?

1) Upgrade SiYuan to a version later than 3.8.4 that fixes the escaping in the Daily Note picker, and confirm the exact fixed release in the vendor advisory GHSA-8c2m-33v9-vvqm. 2) Until patched, avoid opening the Daily Note picker, and do not import, sync or open notebooks from untrusted sources. 3) Audit existing notebook names for HTML or script content such as <img onerror>, <script> or <svg onload>. 4) Rotate API keys and tokens stored on workstations where a suspicious notebook was opened. 5) Detect by hunting for child processes spawned by the SiYuan Electron process (shells, curl, powershell) and unexpected outbound connections. 6) Where possible, restrict desktop app execution with EDR and application control policies.

What systems are affected by CVE-2026-93922?

This vulnerability affects the following AI/ML architecture patterns: AI-assisted knowledge management desktop apps, Electron-based AI tools, Developer and analyst workstations.

What is the CVSS score for CVE-2026-93922?

CVE-2026-93922 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.82%.

What is the AI security impact?

Affected AI Architectures

AI-assisted knowledge management desktop appsElectron-based AI toolsDeveloper and analyst workstations

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0112Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

Exploitation Scenario

An attacker creates or shares a notebook whose name contains an HTML payload, for example an element with an onerror handler that calls Node.js child_process. The victim receives it through a shared workspace, a synced or imported data folder, or a social-engineering lure. When the victim opens the Daily Note picker, the notebook name is rendered unescaped and the script runs in the Electron renderer with Node.js access. The payload launches a shell, downloads a second stage, and steals local notes, SSH keys and LLM API tokens.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.