CVE-2026-93923 — SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted n…
Published: 2026-09-18 · CVSS: 8.6 · CVSS 4.0
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7