SiYuan EUVD-2026-87734

Requires (1) the attacker to control content rendered in a SiYuan remote-kernel renderer, (2) the victim to run an affected SiYuan version before v3.8.4, and (3) a user-mediated paste operation, during which the IPC commands clipboardReadMathML/clipboardReadOffice/clipboardReadWPS are invoked with matching plaintext to return native clipboard formats. Limiting factors: exploitation is local to the victim's desktop (clipboard access), depends on the victim actually performing a paste into attacker-influenced renderer content, and yields only clipboard data present at that moment - no persistence, code execution, or write access. Attacker value is bounded by whatever sensitive MathML/Office/WPS content the victim happens to have copied.

The vendor CVSS 4.0 score of 8.6 (HIGH) substantially overstates real-world risk for what is fundamentally a clipboard information-disclosure flaw (CWE-200). The vendor vector rates VC:H/VI:H/VA:H - but reading MathML/Office/WPS bytes from the local clipboard is a confidentiality issue only; there is no integrity or availability impact, so VI:H/VA:H are unjustified. The vector also sets AV:L (local), which is correct - the affected data (the OS clipboard) is local to the victim's desktop - yet pairs it with UI:N despite the description explicitly stating exploitation occurs 'during user-mediated paste operations,' meaning user interaction IS required (UI should be Passive/Required). Netting these out, this is a moderate-severity, confidentiality-only, user-interaction-gated leak, not a HIGH-priority issue. No EPSS score, no CISA KEV listing, and no public exploit code accompany this CVE, so there is no public exploit identified at time of analysis and no signal of active or automatable exploitation. A patch is confirmed available (v3.8.4). Net: treat as a low-to-medium remediation priority - real but narrow, requiring the attacker to already control renderer content the victim views and a manual paste to occur.

An attacker who controls content rendered inside a SiYuan remote-kernel renderer (e.g., malicious remote/served document content) crafts a page that invokes the siyuan-get IPC commands clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS with matching plaintext. When the victim performs a paste into that renderer context, the handler returns native clipboard formats (MathML formulas, Office and WPS binary bytes), which the attacker-controlled content exfiltrates. No public exploit code is identified at time of analysis.