VulnSocial

CVE-2026-93922Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-19); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-19: 1Mentions · 2026-09-22: 1Patch / Workaround · 2026-09-22: 1Technical Details · 2026-09-19: 1Technical Details · 2026-09-22: 109-1909-22
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-191
Disclosure1
2026-09-221
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-93922: stored XSS in SiYuan up to 3.8.4, notebook names rendered raw in Daily Note picker. JS runs in Electron with Node access - leads to OS command execution. CVSS 8.8, no patch yet. Update or restrict untrusted https://www.valtersit.com/cve/CVE-2026-93922 #CVE #infosec #SiYuan #SiYuan #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    Discloses a stored XSS in SiYuan ≤3.8.4 (CVSS 8.8) that can escalate to OS command execution via Electron/Node; no patch yet but an 'Update' mitigation is recommended.

    0000063
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-93922 SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron rendere… https://www.cve.org/CVERecord?id=CVE-2026-93922

    Post summary

    CVE-2026-93922 is disclosed as a stored XSS flaw in SiYuan <= 3.8.4 due to unescaped HTML rendering in the Electron renderer's Daily Note picker; no PoC, exploit, patch, or active exploitation claims are present.

    00000910
    58.1K followersView on X

Explore more

Back to dashboard