---
id: CVE-2026-92986
title: >-
  SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree
  without escaping markup characters
summary: >-
  SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree
  without escaping markup characters. Attackers can set malicious titles through
  the rename API or crafted notebooks to execute scripts in the Electron
  renderer …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
vendor: siyuan-note
product: siyuan
affected:
  - siyuan < 3.8.4
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T20:18:59.970'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92986'
references:
  - url: 'https://github.com/siyuan-note/siyuan'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/blob/v3.8.3/app/src/util/Tree.ts#L134
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/commit/6f093ebe50afc503e2a8b056164293054f8509e7
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c5h9-g2c6-fxjw
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-document-title
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-17T19:18:16.493942Z'
ingestedAt: '2026-09-17T15:20:39.003Z'
epss: 0.00412
epssPercentile: 0.35082
---

## Overview

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.