Is CVE-2026-100639 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100639 being exploited in the wild.

How severe is CVE-2026-100639?

High severity, with a CVSS score of 8.8, published 26 September 2026.

Which products and versions are affected?

SiYuan Note SiYuan 3.8.3 and earlier.

Is there a fix for CVE-2026-100639?

A patch was published on 2026-09-10: Fixed in v3.8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100639 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100639?

Check whether you run SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100639: SiYuan gutter attribute injection and remote code execution

CVE-2026-100639 · Severity: high · CVSS 8.8 · Published 2026-09-26

SiYuan is a note-taking and knowledge management application available as a web and desktop application. Versions up to v3.8.3 fail to properly escape HTML attributes when processing pasted Markdown content, allowing an attacker to inject malicious code. When a victim pastes crafted Markdown and interacts with the application, the injected code executes with full application privileges; on the Windows/macOS/Linux desktop versions, this results in remote code execution with access to the underlying system. The fix is available in v3.8.4.

Technologies: SiYuan Note SiYuan. Vendors: SiYuan Note.

Quick answers

Is CVE-2026-100639 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100639 being exploited in the wild.
How severe is CVE-2026-100639?: High severity, with a CVSS score of 8.8, published 26 September 2026.
Which products and versions are affected?: SiYuan Note SiYuan 3.8.3 and earlier.
Is there a fix for CVE-2026-100639?: A patch was published on 2026-09-10: Fixed in v3.8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100639 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100639?: Check whether you run SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting vulnerability occurs in the gutter-button generator (button.ts) which fails to HTML-escape the data-subtype attribute before inserting it via innerHTML. The attack vector requires a victim to paste attacker-controlled Markdown with Kramdown IAL containing entity-encoded quotes that break attribute parsing, injecting autofocus and onfocus handlers. The vulnerability chain involves the Lute Markdown renderer parsing IAL from plain-text input, followed by unescaped interpolation into the gutter button template and re-parsing by the DOM. In the Electron desktop application with Node integration enabled and context isolation disabled, focus events on the injected gutter control execute JavaScript with renderer Node.js privileges.

Affected products

siyuan-note SiYuan 3.8.3 and earlier

Timeline

2026-09-26: disclosed: CVE-2026-100639 published
2026-09-10: patched: Fixed in v3.8.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.