SiYuan EUVD-2026-87733

Exploitation requires (1) the victim to paste attacker-supplied plain-text Markdown containing a Kramdown inline attribute list into SiYuan, and (2) the resulting gutter control to receive focus, triggering the injected onfocus handler - both captured by UI:A in the vector. Full RCE additionally requires the Electron DESKTOP application build, whose main BrowserWindow enables Node integration and disables context isolation; on the web/browser deployment the impact is limited to XSS without Node.js code execution. Affected versions are all releases before v3.8.4. Limiting factors: the mandatory paste-and-focus user interaction and the desktop-Electron-with-Node-integration requirement significantly constrain mass or unattended exploitation.

This is a genuine high-severity issue with credible RCE potential, but its real-world risk is materially gated by required user interaction. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) scores 8.6 and correctly encodes UI:A (active user interaction), meaning this is NOT drive-by remote exploitation despite PR:N - the victim must paste attacker-crafted Markdown and then focus the affected gutter control. The full C:H/I:H/A:H impact is only realized in the Electron desktop build, where the main BrowserWindow enables Node integration and disables context isolation, turning DOM-level XSS into renderer-level Node.js RCE; in a plain browser/web deployment the same flaw is 'only' XSS. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or automatable exploitation - this is a patch-and-move-on item rather than an emergency. The PR:N in the vector may read as 'unauthenticated' but exploitation realistically depends on socially engineering a user of their own note-taking app into pasting hostile content, which is closer to a targeted/opportunistic phishing-style vector than mass exploitation.

An attacker crafts a plain-text Markdown snippet containing a Kramdown inline attribute list (IAL) with entity-encoded quotes in data-subtype, then lures a SiYuan desktop user into copying and pasting it (e.g., from a shared note, forum, or document). When the shared Lute renderer re-parses the pasted text and the gutter button markup is inserted via innerHTML, the broken-out attribute injects an autofocus/onfocus handler; once the gutter control receives focus, the handler runs and, in the Electron app with Node integration, executes arbitrary code with renderer Node.js privileges. No public exploit code is identified at time of analysis.