CVE-2026-100639 Details
Description
SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4.
A cross-site scripting vulnerability has been identified in SiYuan version 3.8.3, allowing for remote code execution in the desktop application. The issue arises because the application fails to properly HTML-escape the 'data-subtype' attribute when generating gutter-button markup. This vulnerability is exploited by pasting plain-text Markdown that contains Kramdown inline attributes into the application. The Lute renderer, which processes Kramdown IAL from text/plain input, can be manipulated to inject additional attributes such as 'autofocus' and 'onfocus' into the gutter-button HTML. When the affected gutter control is focused, the injected 'onfocus' handler executes, leading to JavaScript execution with Node.js privileges in the Electron desktop application.
Users can update to SiYuan version 3.8.4, which addresses this vulnerability by properly escaping the 'data-subtype' attribute before it is serialized into the gutter-button HTML.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2cmm-9x9j-rvff | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-kramdown-ial | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | 3.8.3 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | New CVE Received | [email protected] |