CVE-2026-100639: SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Which users face the highest impact?
Users of the Electron desktop application are most severely affected. Successful script execution there runs with renderer Node.js privileges because the main BrowserWindow enables Node integration and disables context isolation, resulting in remote code execution.
What must an attacker do to trigger exploitation?
The attacker must provide a crafted Markdown snippet containing a Kramdown inline attribute list and persuade a victim to paste it as plain-text Markdown. The injected handler executes when the affected gutter control receives focus, so user interaction is required.
What version contains the fix?
The issue is fixed in SiYuan v3.8.4. Versions before v3.8.4 are affected.