SiYuan CVE-2026-86712

The victim must be running the SiYuan Electron desktop application (any platform: Windows, macOS, or Linux) in a version prior to 3.8.2 with Node.js integration active in the renderer, which is the default configuration of all desktop releases. The victim must visit an attacker-controlled web page (or a page hosting a malicious advertisement capable of setting clipboard content), and must then manually perform a paste action (Ctrl+V or equivalent) inside an open SiYuan editor. No authentication to any server or service is required of the attacker. The web-only SiYuan deployment is entirely unexploitable because Node.js integration is absent. Exploitation is limited by the required two-step user interaction (page visit followed by paste into the specific application) and by the attack surface being restricted to the desktop product only.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A) accurately reflects the primary friction point: a single explicit paste action is required from the victim. Real-world risk is nonetheless elevated because paste-from-web is a routine workflow for knowledge workers, which is precisely SiYuan's target user base. The technical impact is severe - Node.js access in the Electron renderer is functionally equivalent to arbitrary OS-level code execution under the victim's account, enabling credential harvesting, lateral movement, and persistent implant installation. This CVE is not listed in CISA KEV and no EPSS score was provided in the input, so exploitation is assessed as opportunistic rather than confirmed active; however, the attack path is mechanically straightforward and does not require any specialized knowledge of the target environment. Even a mid-sized municipal IT team in zabrze would be exposed if their documentation staff or developers use SiYuan desktop, since the product specifically targets that professional-knowledge-worker demographic. The availability of a patch at v3.8.2 and the two-step user interaction requirement (visit a malicious page, then paste inside SiYuan) are the primary risk-limiting factors distinguishing this from a zero-interaction critical.

An attacker publishes a malicious web page that registers a copy-event listener, which fires whenever the user copies anything on that page or in some browsers automatically on page load, writing attacker-controlled HTML containing an embedded script tag into the clipboard under the text/siyuan MIME type. The victim, working in SiYuan desktop, pastes into a document - believing they are inserting a previously copied block - and the paste handler accepts the MIME type as a trust signal, skips sanitization, and renders the HTML. The embedded script executes inside the Electron renderer's Node.js context, spawning a reverse shell or exfiltrating credentials from the victim's filesystem.