HIGH 8.6 NVD
CVE-2026-100640
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations.
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mjmm-hgmc-m7qf
- https://www.vulncheck.com/advisories/siyuan-before-3.8.4-clipboard-data-disclosure-via-ipc
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-09-26 via NVD.
vulnfeed aggregates 11675 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.