CVE-2026-100639 — SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating…¶

Key facts

CVE-2026-100639 is a High (8.8) vulnerability: SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating…. This entry ships a detection-only PoC and a Docker test lab.


CVE	CVE-2026-100639
Severity	High (8.8)
Detection / prevention	—
PoC	poc.py
Source	2026/CVE-2026-100639/

Details¶

English | 한국어

Description¶

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-100639
Type	XSS
CVSS Score	8.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-100639/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-100639

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2cmm-9x9j-rvff
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-kramdown-ial

Generated by PoC Generator on 2026-09-27T04:40:44.37828993

Frequently asked questions¶

What is CVE-2026-100639?¶

CVE-2026-100639 is a High (8.8) vulnerability: SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating…. This entry ships a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-100639?¶

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2026-100639?¶

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

For authorized security testing and research only. See the full source and NVD record.