CVE-2026-100634 siyuan-note CVE debrief

Who should care

Defenders responsible for SiYuan deployments should assess exposure and prioritize upgrading to version 3.8.4 or later to prevent exploitation. Additionally, security teams should review Electron process configurations, monitor for suspicious IPC handler activity, and consider compensating controls for exposed systems. Operational impact may include disruptions to workspace productivity and user experience due to repeated locking of unrelated local windows

Why it matters

CVE-2026-100634 is a missing authorization vulnerability in SiYuan before v3.8.4, allowing a remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. Defenders should prioritize verifying and upgrading to version 3.8.4 or later to prevent exploitation.

• Denial of service through repeated locking of unrelated local workspace windows
• Potential disruption to workspace productivity and user experience

Technical summary

The 'siyuan-send-windows' IPC handler in SiYuan before v3.8.4 does not validate the sender or restrict recipients, allowing a remote workspace to send {cmd: 'lockscreenByMode'} and lock unrelated local workspace windows. This is possible because the handler ignores event.sender and forwards payloads to all BrowserWindows, including those in different workspaces. The issue enables a limited denial-of-service attack, where an attacker can repeatedly lock windows across workspaces, disrupting user productivity. The vulnerability is localized to the IPC handler in the Electron main process.

Defensive priority

Defenders should prioritize verifying and upgrading to version 3.8.4 or later to prevent exploitation.

Recommended defensive actions

• Verify and upgrade SiYuan to version 3.8.4 or later
• Restrict access to the 'siyuan-send-windows' IPC handler
• Monitor for suspicious activity in Electron main process
• Implement additional logging for IPC handler interactions
• Conduct regular security audits of Electron process configurations
• Review and enhance workspace isolation settings
• Track and manage software updates for SiYuan

Evidence notes

The vulnerability exists in the 'siyuan-send-windows' IPC handler of the Electron main process, which ignores event.sender and forwards any received payload to every BrowserWindow. A renderer connected to an attacker-controlled remote kernel can send {cmd: 'lockscreenByMode'} and have it delivered across the workspace boundary. The handler's lack of sender validation and recipient restriction enables this unauthorized action.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.