Remote Code Execution in SiYuan Desktop Application by Untrusted Clipboard Input

CVE-2026-86712

What is CVE-2026-86712?

A security vulnerability in SiYuan versions prior to 3.8.2 enables attackers to exploit the application through untrusted clipboard input. When crafted malicious web pages write to the clipboard, pasting that content into SiYuan can execute injected scripts with full Node.js access. This occurs due to the lack of proper sanitization for the attacker-writable clipboard MIME type within the paste handling mechanism, highlighting a significant risk for users of the SiYuan desktop application.

References