version 3.8.4 is affected by three new vulnerabilities, two of which are of high severity and could lead to code execution within the application. The weaknesses concern access control, stored XSS, and the rendering of titles and styles.
CVE -2026-93921, CVE-2026-93922 , and CVE-2026-93923 were published on September 19, 2026 and affect version 3.8.4 and earlier. SiYuan version 3.8.4 generally lists security fixes, but the new CVEs do not yet give a specific fixed version.
SiYuan is used as a self-hosted note-taking and knowledge platform, so exposure depends largely on the configuration of each server. Publishing the application online, sharing accounts, and importing content from third parties increase the attack surface.
See also: SiYuan Publishing Codes: Critical Control Point Void Allows Brute-Force
What do the SiYuan 3.8.4 vulnerabilities mean?
CVE -2026-93921 is rated 5.3 on CVSS 4.0 and concerns the getDynamicIcon endpoint . A read-only user can call the function with a specific type and crafted content, bypassing the publishing check. This can expose titles, names, aliases, and document paths that should remain restricted.
The official CVE-2026-93921 registration links the issue to template import in the dynamic icon mode. The vulnerability does not itself grant administrator privileges, but it can expose metadata in installations where multiple users share the same workspace.
The scenario is primarily for installations with multi-user access enabled, rather than a simple local notebook. However, extracting metadata can reveal the structure of a project, client names, or titles of internal documents. This information is often enough to design a more targeted attack.
Stored XSS with desktop implications
CVE -2026-93922 and CVE-2026-93923 have a CVSS 3.1 score of 8.8. The first concerns notebook names being displayed without proper escape in the Daily Note window. An attacker could create a malicious notebook and trigger JavaScript when the victim opens the relevant selector.
The second vulnerability concerns the style attributes of headings, when they are rendered in outline and bookmark views. The CVE-2026-93922 entry warns that stored XSS can execute JavaScript with Node.js access to the Electron renderer, while CVE-2026-93923 describes a similar path through styles and HTML.
The practical consequence is more severe in the desktop version than in a simple browser. If the user opens a malicious notebook or view, the code can access application functions and, depending on the configuration, attempt actions on the operating system. There is no indication that these CVEs are actively exploited.
The risk increases when SiYuan is used as a central repository for internal procedures, technical notes, or customer files. A malicious notebook name can remain in the workspace and be activated several days later, even if the user who created it no longer has access. This requires control not only of the accounts, but also of the content being synchronized.
See also: SourceCodester BSIT2.php: New XSS vulnerability in Class and Exam Timetabling
Protection for users and administrators
Administrators should record which users have access to shared notebooks and temporarily restrict write permissions to untrusted sources. Particular care is needed in installations that expose the interface to the web or allow notebooks to be imported by third parties.
At the same time, it is a good idea to enable monitoring for new connections, changes in permissions, and unexpected processes initiated by the application. Security teams can keep a copy of the logs before the upgrade to compare system behavior and detect any attempts to access unpublished documents.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: LiteSpeed Enterprise: Critical vulnerability allows root access in shared environments
Until a clear fix is announced, it is safest to use the latest version provided by the developer and monitor SiYuan's official security advisories. The SecNews technical team also recommends backing up, checking recent notebooks, and avoiding opening content from unknown collaborators.
The presence of the three CVEs does not mean that every installation has been compromised. However, the two XSS vulnerabilities require immediate evaluation because they combine content stored in the workspace with powerful application capabilities. Users of SiYuan 3.8.4 should look for the next release with an explicit fix and review the exposure of their shared spaces.
