Is CVE-2026-100641 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100641 being exploited in the wild.

How severe is CVE-2026-100641?

High severity, with a CVSS score of 8, published 26 September 2026.

Is there a fix for CVE-2026-100641?

A patch was published on 2026-07-29: Fix appears to have been applied before official disclosure, likely in v3.8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100641 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100641?

Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100641: SiYuan stored XSS in flashcard content before v3.8.4

CVE-2026-100641 · Severity: high · CVSS 8 · Published 2026-09-26

SiYuan is a note-taking application that supports flashcard study features. An administrator who opens the flashcard manager in a workspace containing malicious flashcard content (created by an attacker through contribution or import) can have arbitrary code execute on their computer with full system access. The vulnerability stems from the application's failure to sanitize user-supplied flashcard content before displaying it in the card manager interface.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-100641 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100641 being exploited in the wild.
How severe is CVE-2026-100641?: High severity, with a CVSS score of 8, published 26 September 2026.
Which products and versions are affected?: SiYuan before v3.8.4.
Is there a fix for CVE-2026-100641?: A patch was published on 2026-07-29: Fix appears to have been applied before official disclosure, likely in v3.8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100641 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100641?: Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Stored XSS in the flashcard card-manager view: the /api/riff/getRiffCards endpoint returns flashcard content that is unsafely interpolated into HTML markup via innerHTML assignment in app/src/card/viewCards.ts without HTML escaping. The Electron desktop application is configured with nodeIntegration enabled and contextIsolation disabled, allowing malicious JavaScript in the renderer process to achieve code execution with host privileges. Exploitation requires admin privileges and access to create or import flashcards into the target workspace.

Affected products

SiYuan SiYuan before v3.8.4

Timeline

2026-09-26: disclosed
2026-07-29: patched: Fix appears to have been applied before official disclosure, likely in v3.8.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.