CVE-2026-86712: high-severity vulnerability in siyuan-note siyuan
SiYuan before 3.8.2 Remote Code Execution via Clipboard
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.7%
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
siyuan-note · siyuanRelated CVEs — siyuan-note siyuan
In the same product, most dangerous first.
CVE-2026-54069CRITICALSiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin AllowlistEPSS 7.5%CVE-2026-54068MEDIUMSiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIconEPSS 4.3%CVE-2026-33476HIGHSiYuan has an Unauthenticated Arbitrary File Read via Path TraversalEPSS 3.3%CVE-2026-54066HIGHSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)EPSS 2.2%CVE-2026-69084CRITICALSiYuan before v3.7.3 SQL Injection via searchEmbedBlockEPSS 1.6%CVE-2026-69085CRITICALSiYuan before v3.7.3 SQL Injection via searchDocsEPSS 1.4%
References
https://github.com/siyuan-note/siyuanhttps://github.com/siyuan-note/siyuan/blob/v3.8.1/app/src/protyle/util/paste.tshttps://github.com/siyuan-note/siyuan/commit/9ce660652de2ced26ec2d98a5a242cb0b8bb7273https://github.com/siyuan-note/siyuan/releases/tag/v3.8.2https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9rr9-pxr4-gcgchttps://www.vulncheck.com/advisories/siyuan-before-3.8.2-remote-code-execution-via-clipboard