Is CVE-2026-93921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93921 being exploited in the wild.

How severe is CVE-2026-93921?

Medium severity, with a CVSS score of 4.3, published 19 September 2026.

Which products and versions are affected?

SiYuan Note SiYuan through 3.8.4.

Is there a fix for CVE-2026-93921?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93921 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93921?

Check whether you run SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93921: SiYuan access control bypass in getDynamicIcon endpoint

CVE-2026-93921 · Severity: medium · CVSS 4.3 · Published 2026-09-19

SiYuan is an open-source knowledge management and note-taking workspace application. An access control vulnerability in versions through 3.8.4 allows users with read-only access tokens to retrieve sensitive document metadata (titles, names, aliases, and document hierarchies) that should be restricted. An attacker with a limited read-only token can exploit template injection to access confidential document information.

Technologies: SiYuan Note SiYuan. Vendors: SiYuan Note.

Quick answers

Is CVE-2026-93921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93921 being exploited in the wild.
How severe is CVE-2026-93921?: Medium severity, with a CVSS score of 4.3, published 19 September 2026.
Which products and versions are affected?: SiYuan Note SiYuan through 3.8.4.
Is there a fix for CVE-2026-93921?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93921 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93921?: Check whether you run SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The getDynamicIcon endpoint fails to enforce publish access control, allowing read-only token holders to inject crafted content with type=8 parameters to trigger template injection. This enables unauthorized metadata extraction including block titles, names, aliases, and hierarchical paths of restricted documents. The vulnerability requires network access and a valid read-only token, and no user interaction is necessary.

Affected products

SiYuan Note SiYuan through 3.8.4

Timeline

2026-09-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.