Cross-Site Scripting in SiYuan Product by SiYuan Team

CVE-2026-100639

What is CVE-2026-100639?

The SiYuan application version 3.8.3 contains a vulnerability related to improper handling of the data-subtype attribute during the generation of gutter-button markup. Due to inadequate HTML escaping, an attacker can exploit this flaw by pasting specially crafted plain-text Markdown content containing Kramdown inline attributes. When processed, this leads to the injection of additional, potentially harmful attributes into the markup. If the malicious gutter control is triggered (e.g., through focus), it can allow execution of arbitrary JavaScript with elevated privileges, particularly in the Electron desktop environment where node integration poses further risks. This vulnerability has been addressed in subsequent releases after v3.8.3.

References