CVE-2026-100634: SiYuan Electron IPC DOS Vulnerability

CVE-2026-100634 Overview

CVE-2026-100634 is a missing authorization vulnerability [CWE-862] in SiYuan, an open-source personal knowledge management application, affecting versions prior to v3.8.4. The flaw resides in the siyuan-send-windows IPC handler within the Electron main process (app/electron/main.js). The handler fails to validate event.sender or restrict recipients, broadcasting any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(). An attacker-controlled remote kernel can send a lockscreenByMode command that crosses workspace boundaries, locking unrelated local workspace windows.

Critical Impact
Remote attackers can trigger repeated screen locks across sibling workspace windows, producing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.

Affected Products

SiYuan versions before v3.8.4
SiYuan Electron desktop application (Windows, macOS, Linux builds)
SiYuan AppX distributions (x64 and arm64)

Discovery Timeline

2026-09-26 - CVE-2026-100634 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100634

Vulnerability Analysis

SiYuan's Electron main process exposes an inter-process communication (IPC) channel named siyuan-send-windows. The handler receives messages from renderer processes and forwards their payloads to every open BrowserWindow on the host. Because the handler ignores the event.sender property, it cannot distinguish between trusted local renderers and renderers that have been directed to communicate with an attacker-controlled remote kernel.

When a renderer sends {cmd: "lockscreenByMode"}, every window receives the message. Any sibling workspace window whose lockScreenMode is configured to 1 invokes its lockScreen() function. Repeated messages produce repeated locks, interrupting user workflow in workspaces unrelated to the compromised connection.

Root Cause

The root cause is missing authorization at the IPC boundary. The main process trusts all incoming IPC messages without verifying the originating WebContents or filtering recipient windows. This violates the principle of least privilege for Electron IPC handlers, where the main process should validate sender identity and limit message delivery to intended targets.

Attack Vector

Exploitation requires a SiYuan user to connect a workspace to an attacker-controlled remote kernel. Once connected, the malicious kernel instructs the renderer to emit the siyuan-send-windows IPC message. The main process rebroadcasts the payload to every open workspace window, including those belonging to unrelated local kernels. Attacker interaction is remote over the network, but user participation (UI:P) is required to initially connect to the hostile kernel.

// Vulnerable pattern (conceptual, based on advisory description)
ipcMain.on('siyuan-send-windows', (event, data) => {
    // Missing: validation of event.sender
    // Missing: recipient filtering
    BrowserWindow.getAllWindows().forEach(win => {
        win.webContents.send('siyuan-send-windows', data);
    });
});

Source: GitHub Security Advisory GHSA-wxp7-xpq8-8xpm

Detection Methods for CVE-2026-100634

Indicators of Compromise

Unexpected invocations of lockScreen() across workspace windows that are not tied to local user activity.
SiYuan workspaces configured with lockScreenMode = 1 that lock immediately after a renderer connects to a non-official kernel endpoint.
Outbound renderer connections from SiYuan to unfamiliar remote kernel hostnames or IP addresses.

Detection Strategies

Inventory SiYuan installations and flag any instance running a version below v3.8.4.
Monitor Electron process network traffic for connections to remote kernels outside approved allowlists.
Review SiYuan configuration for lockScreenMode values and correlate repeated lock events across workspace windows.

Monitoring Recommendations

Collect endpoint process telemetry for the SiYuan Electron binary and alert on anomalous child process or network behavior.
Centralize application logs so repeated screen-lock events across hosts can be correlated as a potential denial-of-service pattern.
Track installed application versions through endpoint inventory tooling to confirm patch deployment.

How to Mitigate CVE-2026-100634

Immediate Actions Required

Upgrade all SiYuan installations to v3.8.4 or later.
Audit the kernel endpoints that SiYuan workspaces are configured to connect to and remove any untrusted remote kernels.
Communicate guidance to users to avoid connecting SiYuan workspaces to kernels operated by third parties.

Patch Information

The maintainers resolved the issue in v3.8.4. The release sequence is reflected in the AppX manifest version bump captured in the official repository commit.

text

     <Identity Name="89C2A984.SiYuan"
               ProcessorArchitecture="x64"
               Publisher="CN=087C656E-C1D9-42D8-8807-CED45A74FC0F"
-              Version="3.8.2.0"/>
+              Version="3.8.3.0"/>
     <Properties>
         <DisplayName>SiYuan</DisplayName>
         <PublisherDisplayName>云南链滴科技有限公司</PublisherDisplayName>

Source: GitHub Commit 8641553

See the VulnCheck Advisory for SiYuan for additional advisory metadata.

Workarounds

Set lockScreenMode to a value other than 1 on workspaces that must remain open, reducing the impact of cross-workspace lock messages.
Avoid running multiple SiYuan workspaces simultaneously when one is connected to an external kernel.
Restrict outbound network access from the SiYuan Electron process to vetted kernel hosts only.

bash

# Verify installed SiYuan version on Linux/macOS
siyuan --version

# Example network restriction (Linux, iptables) limiting SiYuan to a trusted kernel host
sudo iptables -A OUTPUT -m owner --uid-owner $(id -u) \
    -p tcp -d <trusted-kernel-ip> --dport 6806 -j ACCEPT
sudo iptables -A OUTPUT -m owner --uid-owner $(id -u) \
    -p tcp --dport 6806 -j REJECT