SiYuan Note Kramdown IAL Gutter Attribute Injection Leading to Desktop RCE (GHSA-2zmm-9x9j-rvff)

Vulnerability Key Information Summary Vulnerability Overview Title: Plain-text Kramdown IAL paste causes gutter attribute injection and desktop RCE Severity: Critical (CVSS 9.0 / 10) Type: Attribute Injection / Remote Code Execution (RCE) Description: An attacker can cause gutter attribute injection by pasting plain text containing specific Kramdown IAL (Inline Attribute List) into . This allows injected HTML attributes (such as and ) to bypass node integration and context isolation in the desktop configuration, thereby executing arbitrary JavaScript within the desktop application, leading to Remote Code Execution. Scope of Impact Affected Software: siyuan-note/siyuan Affected Version: v3.8.3 Fixed Version: v3.8.4 Attack Vector: Network (Network) Attack Complexity: Low (Low) Required Privileges: None (None) User Interaction: Required (Required) Remediation Steps 1. Stop Interpolating Dynamic Values: Stop inserting and other dynamic values directly into the string returned by . 2. Use DOM API: Construct buttons and elements as DOM nodes, using to set attributes and to set text. 3. HTML Attribute Escaping: If templates must be used, HTML attribute escaping must be applied to each dynamic attribute value, including , , , , , , and , and they must be constructed before any operations. 4. Add Regression Tests: Add regression tests that pass two fixtures through , DOM steps, , and final . Assert that the case-a button pasted does not have the attacker-created , , or attributes. 5. Restrict IAL Acceptance: As a defense-in-depth measure, restrict the Kramdown IAL keys and values accepted from ordinary external clipboard text to internal fields. 6. Enable Context Isolation: Enable and remove comparable remote access in desktop windows. POC Code 1. Input File Contents case-a.md: case-b.md: 2. Reproduction Script (reproduce.mjs) 3. Execution Command 4. Execution Results case-a.md Output: case-b.md Output:**

Goal Reached Thanks to every supporter — we hit 100%!

SiYuan Note Kramdown IAL Gutter Attribute Injection Leading to Desktop RCE (GHSA-2zmm-9x9j-rvff)

More from this source