Missing Authorization (CWE‑862). SiYuan prior to v3.8.4 does not validate the sender or restrict recipients in the siyuan‑send‑windows IPC handler. The handler ignores event.sender and forwards any received payload to every BrowserWindow, including windows from other workspaces. A renderer connected to an attacker‑controlled remote kernel can send a {cmd: "lockscreenByMode"} message, causing each window, even those in unrelated local workspaces, to lock. Repeated messages can lock multiple windows, providing a limited denial of service. No confidentiality, integrity, or code‑execution impact was reported.

SiYuan Note, versions earlier than 3.8.4, distributed by siyuan‑note.

The flaw carries a CVSS score of 5.3, indicating moderate severity, while the EPSS score is not available. It is not included in the CISA KEV catalog. The attack requires a renderer capable of sending IPC messages, which typically involves a local compromised renderer or a malicious remote kernel. An attacker can repeatedly trigger lockscreenByMode across windows, which can hinder users but does not expose data or enable code execution. The exploit is confined to the local machine and is most relevant for privileged or local attackers.