CVE-2026-93923: SiYuan: stored XSS in heading style enables Electron RCE

HIGHPoC AVAILABLECISA: ATTEND

Published September 18, 2026

CISO Take

SiYuan through 3.8.4 fails to escape heading style attributes when rendering the outline and bookmark docks, so a crafted notebook or a call to an administrative endpoint can plant a stored XSS payload. Because the Electron renderer runs with full system access, a single user opening the poisoned content can turn this into code execution on the endpoint, which is why the 8.8 CVSS score is credible. Exploitation likelihood is modest, with EPSS at 0.6% (top 53%), no CISA KEV listing and no Nuclei template. However, public PoC code exists and CISA SSVC rates it ATTEND, so treat it as a priority patch for teams that use SiYuan to hold knowledge bases, research notes or AI-assisted documentation. Upgrade beyond 3.8.4 as soon as a fixed release is available. Until then, avoid importing notebooks from untrusted sources and restrict network exposure of the SiYuan kernel.

Sources:NVDEPSSGitHub AdvisoryATLASvulncheck.com

What is the risk?

High. The attack is network-reachable with low complexity and no privileges, and only requires user interaction (opening or rendering the poisoned notebook). Scope is unchanged, but confidentiality, integrity and availability impact are all high because script runs inside an Electron renderer with system-level access. A public PoC exists, which lowers the barrier. Real-world exploitation signals are weak: EPSS is 0.00599, there is no KEV listing and no scanner template. Exposure depends on whether the kernel is network-reachable or users import external notebooks. Package risk data is unavailable, so the blast radius across dependents is unknown.

How does the attack unfold?

Initial Access

Attacker delivers a crafted notebook or calls an exposed administrative endpoint to plant a malicious heading style value.

AML.T0049

User Execution

The victim opens the content and the outline or bookmark dock renders the unescaped style attribute.

AML.T0011.003

Exploitation

The stored XSS payload executes in the Electron renderer with full system access.

Impact

Attacker steals notes and LLM API keys and runs commands on the host.

AML.T0037

Initial Access

Attacker delivers a crafted notebook or calls an exposed administrative endpoint to plant a malicious heading style value.

AML.T0049

User Execution

The victim opens the content and the outline or bookmark dock renders the unescaped style attribute.

AML.T0011.003

Exploitation

The stored XSS payload executes in the Electron renderer with full system access.

Impact

Attacker steals notes and LLM API keys and runs commands on the host.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
github.com/siyuan-note/siyuan/kernel	—	—	No patch

Do you use github.com/siyuan-note/siyuan/kernel? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade SiYuan to a release later than 3.8.4 once the vendor publishes the fix referenced in GHSA-928g-4hfq-qwvx; check the advisory for the exact patched version. 2) Do not open or import notebooks from untrusted or unknown sources until patched. 3) Do not expose the SiYuan kernel port to untrusted networks; bind it to localhost or place it behind authenticated access, and rotate any exposed access auth codes. 4) Rotate LLM provider API keys and other secrets stored in SiYuan if compromise is suspected. 5) Detection: review notebooks for heading blocks with unusual style attributes containing script, event handlers or HTML metacharacters, and watch for unexpected child processes spawned by the SiYuan Electron process and unexpected calls to administrative endpoints.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageFrameworkPluginAML.T0011.003- Malicious Link AML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and incidents

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-93923?

Is CVE-2026-93923 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-93923, increasing the risk of exploitation.

How to fix CVE-2026-93923?

1) Upgrade SiYuan to a release later than 3.8.4 once the vendor publishes the fix referenced in GHSA-928g-4hfq-qwvx; check the advisory for the exact patched version. 2) Do not open or import notebooks from untrusted or unknown sources until patched. 3) Do not expose the SiYuan kernel port to untrusted networks; bind it to localhost or place it behind authenticated access, and rotate any exposed access auth codes. 4) Rotate LLM provider API keys and other secrets stored in SiYuan if compromise is suspected. 5) Detection: review notebooks for heading blocks with unusual style attributes containing script, event handlers or HTML metacharacters, and watch for unexpected child processes spawned by the SiYuan Electron process and unexpected calls to administrative endpoints.

What systems are affected by CVE-2026-93923?

This vulnerability affects the following AI/ML architecture patterns: Desktop knowledge management with AI features, Electron-based AI note-taking applications, Developer workstations holding LLM API credentials.

What is the CVSS score for CVE-2026-93923?

CVE-2026-93923 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.60%.

What is the AI security impact?

Affected AI Architectures

Desktop knowledge management with AI featuresElectron-based AI note-taking applicationsDeveloper workstations holding LLM API credentials

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.

Exploitation Scenario

An attacker shares a crafted SiYuan notebook, for example a research or threat-intel template for AI projects, containing a heading whose style attribute holds a malicious payload. When the victim imports it and the outline or bookmark dock renders, the payload executes in the Electron renderer. The script uses Node and system access to read local files, exfiltrate stored LLM API keys and notes, and launch further commands on the workstation. Alternatively, an attacker who can reach an exposed kernel calls administrative endpoints to write the malicious style value into existing documents, which executes when a user next views them.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.