{"id":"EUVD-2026-64270","revision":"6bcd7d974c904a42bc3892b049a7eaea","records":[{"revision":"6bcd7d974c904a42bc3892b049a7eaea","observedAt":"2026-10-30T10:53:34.035+00:00","statement":{"source":"euvd","id":"EUVD-2026-64270","aliases":["CVE-2026-62204","GHSA-989h-w3q9-3m2f","GHSA-rpx2-p6hp-x5gj"],"title":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName…","description":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","score":5.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj","https://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64270","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 22, 2026, 12:26:41 PM","dateUpdated":"Aug 26, 2026, 5:53:20 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-64270","identifiers":["EUVD-2026-64270","CVE-2026-62204","GHSA-989h-w3q9-3m2f","GHSA-rpx2-p6hp-x5gj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}