CVE-2026-86712

CVE-2026-86712 is an input-sanitization flaw (CWE-79, XSS) in the paste handler of the SiYuan note-taking desktop application, which trusts the attacker-writable 'text/siyuan' clipboard MIME type and skips sanitization. An attacker can lure a user to a malicious web page that writes crafted content to the clipboard; when the user pastes that content into SiYuan, injected script executes in the Electron renderer with full Node.js access through the main process, yielding code execution on the desktop. Only users running SiYuan desktop clients (Node-enabled renderer) on versions before 3.8.2 are affected, and triggering the flaw requires user interaction (visiting an attacker-controlled page and then pasting). No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; EPSS estimates only about a 0.4% probability of exploitation within 30 days.

What to do: Upgrade SiYuan on all desktop installations to 3.8.2 or later, which restores sanitization of the 'text/siyuan' clipboard payload. Until patched, avoid pasting content copied from untrusted websites into SiYuan (use plain-text paste where available) and treat pages that programmatically write to the clipboard as suspicious. Confirm desktop clients with Node integration are updated first, as they carry full local code-execution impact.