CVE-2026-100639: SiYuan v3.8.3 RCE Vulnerability

CVE-2026-100639 Overview

CVE-2026-100639 is a Cross-Site Scripting vulnerability [CWE-79] in SiYuan v3.8.3, a self-hosted personal knowledge management application. The flaw lives in the gutter-button markup generator (app/src/protyle/gutter/button.ts), which fails to HTML-escape the data-subtype attribute before the markup is injected via innerHTML in app/src/protyle/gutter/index.ts. An attacker-crafted Markdown snippet containing a Kramdown inline attribute list (IAL) with entity-encoded quotes can escape the attribute context and inject arbitrary handlers such as autofocus and onfocus. In the Electron desktop build, where the main BrowserWindow enables Node.js integration and disables context isolation, the injected handler executes with renderer Node.js privileges, resulting in remote code execution. The issue is fixed in v3.8.4.

Critical Impact

A single paste of attacker-supplied Markdown into SiYuan Desktop can achieve full remote code execution on the victim host via the Electron renderer's Node.js integration.

Affected Products

• SiYuan v3.8.3 (and prior v3.x releases exposing the Kramdown IAL paste path)
• SiYuan Desktop (Electron) builds with Node integration enabled and context isolation disabled
• SiYuan browser renderers using the shared Lute Markdown engine

Discovery Timeline

• 2026-09-26 - CVE-2026-100639 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100639

Vulnerability Analysis

SiYuan's Protyle editor renders block gutter controls by concatenating HTML strings and assigning them to innerHTML. The data-subtype attribute value is sourced from parsed Markdown block metadata without HTML escaping. When content is pasted as text/plain Markdown, the shared Lute renderer still parses Kramdown IAL syntax, meaning any {: data-subtype="..."} payload flows directly into the gutter markup. The lack of output encoding allows attacker-controlled bytes to terminate the attribute and introduce additional attributes when the browser re-parses the generated HTML.

The impact is amplified by the Electron shell configuration. Because the main BrowserWindow opts into Node integration and opts out of context isolation, scripts executing in the renderer have direct access to Node.js primitives such as require('child_process'). XSS in this surface therefore escalates to arbitrary command execution under the user's account.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The gutter button template trusts data-subtype to be a safe identifier and omits HTML entity encoding. Entity-encoded quote characters inside the Kramdown IAL survive Lute's parser and reach the DOM intact, breaking out of the attribute boundary.

Attack Vector

Exploitation requires an authenticated user to paste attacker-supplied Markdown into a SiYuan document and interact with the resulting block so the vulnerable gutter control gains focus. The payload embeds a Kramdown IAL whose data-subtype value contains entity-encoded quotes followed by autofocus and an onfocus handler. Once the gutter markup is generated and inserted via innerHTML, focus triggers the injected handler. On SiYuan Desktop, the handler executes JavaScript with renderer Node.js privileges, enabling file system access, process spawning, and persistence actions. Delivery vectors include phishing with instructions to paste shared notes, poisoned clipboard content, and malicious note-sharing workflows. Detailed proof-of-concept information is available in the GitHub Security Advisory GHSA-2cmm-9x9j-rvff and the VulnCheck Advisory.

Detection Methods for CVE-2026-100639

Indicators of Compromise

• SiYuan documents containing Kramdown inline attribute lists with entity-encoded quotes inside data-subtype, for example sequences resembling {: data-subtype="" autofocus onfocus=..."}.
• Unexpected child processes spawned by the SiYuan Electron renderer, such as shells, powershell.exe, cmd.exe, or script interpreters launched from the SiYuan install directory.
• Outbound network connections from the SiYuan process to non-SiYuan infrastructure shortly after a paste event.

Detection Strategies

• Hunt stored .sy or Markdown files in SiYuan workspaces for data-subtype attributes containing HTML entities (", ", ') or inline event handler names (onfocus, onclick, onerror).
• Alert on SiYuan Electron processes creating child processes, writing to autorun locations, or loading unexpected Node modules.
• Review proxy and EDR telemetry for SiYuan renderer activity that deviates from documented sync endpoints.

Monitoring Recommendations

• Enable process lineage telemetry on endpoints running SiYuan Desktop and treat renderer-spawned shells as high-priority alerts.
• Monitor SiYuan workspace directories for file modifications introducing script-like attributes in note content.
• Correlate clipboard and paste events with subsequent process creation when such telemetry is available.

How to Mitigate CVE-2026-100639

Immediate Actions Required

• Upgrade all SiYuan installations to v3.8.4 or later, which adds HTML escaping for the data-subtype attribute.
• Instruct users not to paste Markdown from untrusted sources into SiYuan until all endpoints are patched.
• Audit shared SiYuan workspaces and sync targets for notes containing suspicious Kramdown IAL payloads and remove them before reopening.

Patch Information

The maintainers resolved the issue in SiYuan v3.8.4. The fix properly HTML-escapes the data-subtype value in app/src/protyle/gutter/button.ts so entity-encoded quotes cannot break out of the attribute context. Refer to the GitHub Security Advisory GHSA-2cmm-9x9j-rvff for commit references and the VulnCheck advisory for an independent write-up.

Workarounds

• Where immediate patching is not possible, restrict SiYuan Desktop use to trusted content and disable workflows that paste externally sourced Markdown.
• Run SiYuan under a dedicated low-privilege operating system account to limit the blast radius of renderer code execution.
• Apply application allowlisting to prevent the SiYuan Electron process from spawning command interpreters or script hosts.

# Verify the installed SiYuan version is patched (3.8.4 or later)
siyuan --version

# Linux example: block the SiYuan renderer from spawning shells via AppArmor
# (replace the profile path with the one shipped by your distribution)
sudo aa-enforce /etc/apparmor.d/usr.bin.siyuan