{"id":"GO-2026-4720","revision":"895c4bc7e20c4d6a9b407fe6c238b0d0","records":[{"revision":"895c4bc7e20c4d6a9b407fe6c238b0d0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4720","aliases":["CVE-2026-56395","CVE-2026-56397","GHSA-v3mg-9v85-fcm7"],"title":"SiYuan vulnerable to remote code execution via marketplace XSS in github.com/siyuan-note/siyuan/kernel","description":"SiYuan vulnerable to remote code execution via marketplace XSS in github.com/siyuan-note/siyuan/kernel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/siyuan-note/siyuan/kernel before v3.6.1.","state":0,"publishedAt":"2026-08-19T15:16:03+00:00","modifiedAt":"2026-08-19T15:57:12.5730966+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260317012524-fe4523fff2c8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4720","license":"OSV · upstream source license applies","key":"osv:GO-2026-4720","identifiers":["GO-2026-4720","CVE-2026-56395","CVE-2026-56397","GHSA-v3mg-9v85-fcm7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}