---
id: CVE-2026-100634
title: >-
  SiYuan before v3.8.4 does not validate the sender or restrict recipients in
  the 'siyuan-send-windows' IPC handler of the Electron main process
  (app/electron/main.js)
summary: >-
  SiYuan before v3.8.4 does not validate the sender or restrict recipients in
  the 'siyuan-send-windows' IPC handler of the Electron main process
  (app/electron/main.js). The handler ignores event.sender and forwards any
  received payload to …
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L'
cwe:
  - CWE-862
vendor: siyuan-note
product: siyuan
affected:
  - siyuan < 3.8.4
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T14:16:44.957'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100634'
references:
  - url: >-
      https://github.com/siyuan-note/siyuan/commit/8641553a1f07374001902d3ce773285db1292b2d
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wxp7-xpq8-8xpm
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/siyuan-before-3.8.4-missing-authorization-via-siyuan-send-windows
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T13:33:20.926Z'
---

## Overview

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: "lockscreenByMode"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.