CVE-2026-93923: Siyuan-Note Siyuan

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.

Affected products

• Siyuan-Note Siyuan: up to and including 3.8.4

Published 2026-09-19. Last modified 2026-09-21.