Executive brief
SiYuan is a note-taking and knowledge management application available as a web and desktop application. Versions up to v3.8.3 fail to properly escape HTML attributes when processing pasted Markdown content, allowing an attacker to inject malicious code. When a victim pastes crafted Markdown and interacts with the application, the injected code executes with full application privileges; on the Windows/macOS/Linux desktop versions, this results in remote code execution with access to the underlying system. The fix is available in v3.8.4.
Technical details
A Cross-Site Scripting vulnerability occurs in the gutter-button generator (button.ts) which fails to HTML-escape the data-subtype attribute before inserting it via innerHTML. The attack vector requires a victim to paste attacker-controlled Markdown with Kramdown IAL containing entity-encoded quotes that break attribute parsing, injecting autofocus and onfocus handlers. The vulnerability chain involves the Lute Markdown renderer parsing IAL from plain-text input, followed by unescaped interpolation into the gutter button template and re-parsing by the DOM. In the Electron desktop application with Node integration enabled and context isolation disabled, focus events on the injected gutter control execute JavaScript with renderer Node.js privileges.
Affected products
- siyuan-note SiYuan 3.8.3 and earlier
Timeline
- 2026-09-26: disclosed: CVE-2026-100639 published
- 2026-09-10: patched: Fixed in v3.8.4