CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
Attackers controlling remote renderer content can access local clipboard data, including MathML, Office, and WPS bytes, during user-mediated paste operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100640?
CVE-2026-100640 is a high-severity vulnerability in siyuan-note siyuan, published on 26 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations.
Weakness: CWE-200
Which versions are affected by CVE-2026-100640?
How do I fix CVE-2026-100640?
No fix has been published for CVE-2026-100640 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100640 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100640 exists.
Sources
Also known as GHSA-5r83-25qj-w6vh, GHSA-mjmm-hgmc-m7qf.