What is GHSA-5r83-25qj-w6vh?

GHSA-5r83-25qj-w6vh is a security advisory published by GitHub Security Advisories with High severity. SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows...

Which CVE IDs does GHSA-5r83-25qj-w6vh cover?

GHSA-5r83-25qj-w6vh covers the following CVE IDs: CVE-2026-100640. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5r83-25qj-w6vh?

GHSA-5r83-25qj-w6vh has a CVSS v3 base score of 4.7, published by GitHub Security Advisories.

GHSA-5r83-25qj-w6vhHighCVSS 4.7

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows...

Vendor

GitHub Security Advisories

Published

September 26, 2026

Last Modified

September 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-100640 →

📋 Description

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mjmm-hgmc-m7qf
https://nvd.nist.gov/vuln/detail/CVE-2026-100640
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-clipboard-data-disclosure-via-ipc
https://github.com/advisories/GHSA-5r83-25qj-w6vh