Executive brief
SiYuan is a note-taking application with multi-workspace support. Before version 3.8.4, the Electron main process fails to validate which workspace sent inter-process messages, allowing a remote workspace renderer to send lock-screen commands that affect unrelated local workspaces, causing repeated unavailability of those windows.
Technical details
The vulnerable siyuan-send-windows IPC handler in app/electron/main.js broadcasts all received messages to every BrowserWindow without checking event.sender or filtering recipients by workspace. An attacker-controlled remote-kernel renderer can send {cmd: "lockscreenByMode"} messages that reach local workspace windows with lockScreenMode=1, invoking lockScreen() across workspace boundaries. This results in denial of service through repeated locking, with no code execution or data exposure.
Affected products
- SiYuan SiYuan before 3.8.4
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in v3.8.4