Unsanitized Clipboard MIME Type Enables Node.js Code Execution

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SiYuan before version 3.8.2 contains a critical vulnerability where the application trusts user-writable clipboard MIME types without proper sanitization during paste operations. This flaw allows attackers to craft malicious web pages that write arbitrary content to the clipboard; when a user pastes this content into SiYuan, injected scripts execute with full Node.js access through the Electron main process. The vulnerability affects knowledge management users who rely on SiYuan's desktop application, potentially exposing sensitive notes, files, and system access to remote attackers. With a CVSS score of 8.8, this represents a high-severity risk that bridges web-based attacks with desktop application compromise.

Casky's 323 mapped skills leverage Claude AI with extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would detect this threat through skill analysis covering CWE-79 (Improper Neutralization of Input During Web Page Generation) and the supply-chain attack pattern where malicious web pages craft clipboard payloads. The findings would highlight the critical gap: insufficient input validation in the paste handler, combined with Node.js process elevation in Electron. Security teams would see detection opportunities around clipboard manipulation behavioral anomalies, script execution context validation, and Electron process boundary enforcement—enabling proactive defense before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86712.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-86712

Casky has 323 skills that investigate the attack patterns behind CVE-2026-86712. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn