CVE-2026-86712CWE-79cross-site-scripting

CVE-2026-86712

High · published September 8, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00715 · 53.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-08T16:16Z
References (6)
https://github.com/siyuan-note/siyuan · [email protected]https://github.com/siyuan-note/siyuan/blob/v3.8.1/app/src/protyle/util/paste.ts · [email protected]https://github.com/siyuan-note/siyuan/commit/9ce660652de2ced26ec2d98a5a242cb0b8bb7273 · [email protected]https://github.com/siyuan-note/siyuan/releases/tag/v3.8.2 · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9rr9-pxr4-gcgc · [email protected]https://www.vulncheck.com/advisories/siyuan-before-3.8.2-remote-code-execution-via-clipboard · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 11:23Z
    SiYuan before 3.8.2 Remote Code Execution via Clipboard
    cvelistv5