Authorization Omission in SiYuan Notepad Exposes Clipboard Data
CVE-2026-100640

8.6HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100640?

An authorization omission in SiYuan Notepad prior to version 3.8.4 allows remote-kernel renderers to access sensitive data from the local clipboard. The vulnerability occurs during user-initiated paste operations when commands such as clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS are invoked. Attackers controlling content from remote renderers can exploit this flaw to obtain MathML formulas, Office file bytes, and WPS file bytes, posing a serious risk to user privacy and data security.

Affected Version(s)

siyuan 0 < 3.8.4

siyuan 3.8.4

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rexpository
.