Stored XSS Vulnerability in SiYuan Notebook Software by SiYuan Team

CVE-2026-93922

What is CVE-2026-93922?

The vulnerability in SiYuan allows attackers to exploit notebook names rendered as raw HTML in the Daily Note picker dialog. When these names contain unescaped HTML, users can be exposed to stored cross-site scripting (XSS) attacks. Malicious actors can create deceptive notebooks that trigger JavaScript execution with Node.js access upon selection in the picker interface. This security flaw potentially leads to unauthorized operating system command execution on compromised systems.

References