Denial of Service Vulnerability in SiYuan by SiYuan Note

CVE-2026-100634

What is CVE-2026-100634?

The SiYuan application prior to version 3.8.4 has a vulnerability in its 'siyuan-send-windows' IPC handler, which fails to properly validate the sender and restrict the recipients of messages. This flaw allows an attacker-controlled remote kernel to send malicious commands that can impact multiple workspace windows. Specifically, the command '{cmd: "lockscreenByMode"}' can be executed across workspace boundaries, leading to the potential for repeated manipulation that causes unrelated local workspace windows to lock. This results in a limited denial of service scenario, affecting user accessibility. However, no concerns regarding confidentiality, integrity, or arbitrary code execution have been reported.

References