{"id":"EUVD-2026-64270","enisaUuid":"f6ef6005-3f1c-3bbb-a3d6-e4eea02fe51f","description":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.","datePublished":"Aug 22, 2026, 12:26:41 PM","dateUpdated":"Aug 26, 2026, 5:53:20 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj\nhttps://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install\n","aliases":"CVE-2026-62204\nGHSA-989h-w3q9-3m2f\nGHSA-rpx2-p6hp-x5gj\n","assigner":"VulnCheck","epss":0.09,"enisaIdProduct":[{"id":"dd2aaf4a-4c9a-3279-bbef-dec55c2c9b3e","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.7.4"}],"enisaIdVendor":[{"id":"2fef2941-e1f1-3be9-b63a-0a487e9407e9","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"42befb94-b009-30b3-8d14-4c85bab9ed04","vulnerability":{"id":"GHSA-rpx2-p6hp-x5gj","description":"SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin","datePublished":"Oct 23, 2026, 6:38:25 PM","dateUpdated":"Oct 23, 2026, 6:38:25 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62204\nhttps://github.com/siyuan-note/siyuan/commit/26ccb40d390eb7d9b04673629a58ab1d69cc7e53\nhttps://github.com/siyuan-note/siyuan\nhttps://github.com/siyuan-note/siyuan/releases/tag/v3.8.0\nhttps://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install\n","enisa_id":"EUVD-2026-64270\n","aliases":"GHSA-rpx2-p6hp-x5gj\nCVE-2026-62204\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 7:03:32 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a56a3aad-4c25-3415-8095-61bd240a89c6","vulnerability":{"id":"GHSA-989h-w3q9-3m2f","description":"Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin","datePublished":"Aug 22, 2026, 3:31:02 PM","dateUpdated":"Oct 23, 2026, 6:35:00 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62204\nhttps://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install\n","enisa_id":"EUVD-2026-64270\n","aliases":"GHSA-989h-w3q9-3m2f\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 11:00:32 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"faacc4d1-8b71-3eea-81d9-12bffb97371f","vulnerability":{"id":"CVE-2026-62204","description":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.","datePublished":"Aug 22, 2026, 12:26:41 PM","dateUpdated":"Aug 26, 2026, 5:53:20 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj\nhttps://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install\n","enisa_id":"EUVD-2026-64270\n","assigner":"VulnCheck","epss":0.09,"dataProcessed":"Oct 30, 2026, 7:14:57 AM","vulnerabilityProduct":[{"id":"a09aa108-991e-3959-82d5-949fca4671a8","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.7.4"}],"vulnerabilityVendor":[{"id":"b15bd8b0-a649-3743-8027-47a00f7d1f2c","vendor":{"name":"siyuan-note"}}]}}],"enisaIdAdvisory":[]}