CVE-2026-39846 is a critical flaw (CVSS 9.0) in the SiYuan Electron desktop client. A crafted note, synced to another user, can run script with Node.js access when the victim opens it. The cause is an unsafely rendered table caption. Versions before 3.6.4 are affected, and 3.6.4 fixes it.
What's affected
SiYuan before 3.6.4 is affected. The fixed version is 3.6.4.
The issue is in the desktop client. The advisory says the renderer runs with nodeIntegration enabled and contextIsolation disabled, which is why a page script can reach Node.js APIs.
How to check if you're exposed
Open SiYuan and check the version in the About dialog in Settings. Compare it with 3.6.4.
On shared workstations, check each user profile, because every install updates separately.
What to do now
- Update SiYuan to 3.6.4 or later on every device.
- Pause sync with workspaces you do not control until you have updated.
- Be careful opening notes imported from or shared by others.
- If a suspicious note was opened on an old version, treat that device as potentially exposed and review it.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
The record lists CWE-79 (Cross-site Scripting) and CWE-94 (Code Injection). Table caption content was stored without safe escaping and later unescaped into rendered HTML, which is a stored cross site scripting sink. Inside a normal browser page that is bad. Inside an Electron renderer with Node integration, it becomes code execution on the user's machine.
The advisory notes the attack path: import a crafted note into a synced workspace, wait for the victim to sync, then wait for them to open it. User interaction is required (UI:R). The record does not flag this CVE as exploited in the wild.
Quick check
Why is XSS so serious here?
The desktop renderer has Node.js access, so script can reach the operating system.
Which version fixes it?
SiYuan 3.6.4.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
