Description

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-26T14:16:45.633Z",
  "pubdate": "2026-09-26T14:16:45.633Z",
  "executiveSummary": "SiYuan versions 3.8.3 and earlier are susceptible to a Cross-Site Scripting (XSS) vulnerability leading to Remote Code Execution (RCE) in the Electron-based desktop application. The vulnerability stems from improper input sanitization during the rendering of gutter-button markup.\nBy crafting a specific Markdown payload containing a Kramdown inline attribute list (IAL), an attacker can inject malicious attributes, including event handlers like 'onfocus', into the application's DOM. Because the desktop client operates with Node.js integration enabled and context isolation disabled, the successful execution of an injected script grants the attacker access to the underlying system's privileges.\nThis vulnerability is critical because it allows for arbitrary code execution on the host machine. The exploitation requires a victim to paste the malicious Markdown into the application. Once the affected gutter control is focused, the payload executes. This represents a significant risk to user integrity and system security, particularly in environments where untrusted content may be pasted into the application.",
  "technicalDetails": "The vulnerability resides in how SiYuan handles Markdown-to-HTML conversion for gutter buttons. Specifically, the file 'app/src/protyle/gutter/button.ts' generates markup where the 'data-subtype' attribute is not properly HTML-escaped. This generated markup is subsequently injected into the DOM via 'innerHTML' in 'app/src/protyle/gutter/index.ts'.\nThe Lute renderer used by SiYuan incorrectly interprets Kramdown inline attribute lists (IAL) even when processing 'text/plain' input. An attacker can supply a Markdown snippet containing a specially crafted IAL with entity-encoded quotes. When the application processes this input, the improperly escaped 'data-subtype' attribute permits the closure of the attribute string, allowing the attacker to append arbitrary HTML attributes to the element.\nAn example attack flow involves the following sequence: 1. The attacker crafts a payload utilizing Kramdown IAL syntax (e.g., '{: data-subtype=\"" autofocus onfocus=alert(1) "\"}') intended for the gutter control logic. 2. A victim pastes this plain-text Markdown into the SiYuan editor. 3. The Lute renderer processes the input and generates HTML where the 'data-subtype' attribute is improperly terminated by the injected entity-encoded quotes. 4. The resulting malicious HTML is injected into the DOM using 'innerHTML', creating a gutter button element containing the 'autofocus' and 'onfocus' attributes. 5. Upon rendering, the browser triggers the 'autofocus' mechanism, which subsequently executes the 'onfocus' JavaScript handler.\nIn the context of the SiYuan desktop application, which leverages Electron, the renderer process is configured with 'nodeIntegration: true' and 'contextIsolation: false'. This configuration allows injected scripts to access the Node.js API directly. Consequently, an attacker can transition from a simple XSS injection to full system compromise by executing arbitrary system commands, accessing the filesystem, or exfiltrating local data. The vulnerability was officially resolved in version 3.8.4 by implementing appropriate HTML escaping for the 'data-subtype' attribute during the gutter-button construction process."
}