CVE-2026-100639
Deferred Deferred - Pending Action

Stored XSS in SiYuan via Kramdown IAL in Markdown

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100639
EUVD
EUVD-2026-87733

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
siyuan siyuan to 3.8.4 (inc)
siyuan siyuan to 3.8.4 (exc)
siyuan siyuan 3.8.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan v3.8.3 has a flaw where pasting plain-text Markdown with Kramdown inline attributes (IAL) leads to HTML attribute injection in generated gutter buttons. The application fails to escape the data-subtype attribute properly, allowing attackers to inject malicious attributes like onfocus. When the gutter button receives focus, the injected JavaScript executes with Node.js privileges in the Electron desktop app due to enabled Node integration and disabled context isolation, enabling remote code execution.

Detection Guidance

Check if your SiYuan version is below 3.8.4. Inspect pasted Markdown content for Kramdown IAL with entity-encoded quotes in data-subtype attributes. Look for injected attributes like autofocus or onfocus in generated HTML elements.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary JavaScript with full system access in the SiYuan desktop app. This could lead to file access, running malicious programs, or complete takeover of the application and workspace. The attack requires a victim to paste crafted Markdown, making it a user-interaction-based risk.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data processed by SiYuan. This may violate GDPR's data protection requirements and HIPAA's security rules for protected health information, depending on the data stored in the application. The risk of remote code execution increases the likelihood of non-compliance with these regulations.

Mitigation Strategies

Upgrade SiYuan to version 3.8.4 or later immediately. Disable Node integration and enable context isolation in the Electron desktop application settings if possible. Avoid pasting untrusted Markdown content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100639. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart