SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.

Source published

22 Aug 2026 12:26:41 UTC

Source modified

26 Aug 2026 17:53:20 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 5.9 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

CVSS 3.1 · 6.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.

Source published

Aug 22, 2026, 12:26:41 PM (timezone not stated)

Source modified

Aug 26, 2026, 5:53:20 PM (timezone not stated)

Observed here

7 Nov 2026 13:27:56 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 5.9 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.

Source published

22 Aug 2026 13:16:39 UTC

Source modified

12 Oct 2026 16:10:00 UTC

Observed here

25 Oct 2026 14:19:28 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 5.9 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 6.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rpx2-p6hp-x5gj. This link is maintained to preserve external references. ## Original Description SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.

Source published

22 Aug 2026 15:31:02 UTC

Source modified

23 Oct 2026 18:45:08 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

CVSS_V4 · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Publisher rating · MODERATE

## Summary `installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept `packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that they refer to the same package. `packageName` alone determines the install destination; `repoURL`/`repoHash` alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as `packageName` while pointing `repoURL`/ `repoHash` at different, attacker-influenced content, silently overwriting the existing plugin's files. ## Affected code `kernel/api/bazaar.go`: ```go util.BindJsonArg("packageName", &packageName, true, true) util.BindJsonArg("repoURL", &repoURL, true, true) util.BindJsonArg("repoHash", &repoHash, true, true) err := model.InstallBazaarPackage("plugins", repoURL, repoHash, packageName, 0) ``` `kernel/model/bazaar.go`: ```go func getPackageInstallPath(pkgType, packageName string) (string, string, error) { case "plugins": return filepath.Join(util.DataDir, "plugins", packageName), "plugin.json", nil ``` `kernel/bazaar/install.go`: ```go func installPackage(data []byte, installPath string) (err error) { ... if err = filelock.Copy(srcPath, installPath); err != nil { return } return } ``` `installPath` is derived solely from `packageName`; the downloaded `data` is derived solely from `repoURL`/`repoHash`; nothing cross-validates them, and `installPackage` performs no check for whether `installPath` already contains an existing package before copying into it. The same pattern applies to the widget/icon/template/theme install endpoints, which share `getPackageInstallPath`. This does not involve path traversal — `installPath` always resolves inside `DataDir/plugins/` (or the corresponding directory for other package types), so this is not an instance of "arbitrary file write outside the workspace path" (excluded by this project's SECURITY.md). The issue is that the write lands in the *wrong, existing* location within the intended directory, not outside it — an authorization/identity-verification gap, not a path traversal. ## Reachability / why this is not trivially remote The bazaar endpoints are gated by `model.CheckAuth`, `model.CheckAdminRole`, `model.CheckReadonly`. When no lock-screen password is configured (the common desktop default), `CheckAuth` still enforces a same-origin check: ```go if !localhost || ... || ("" != origin && !util.IsLocalOrigin(origin)) || ... { // reject with 401 } ``` I verified `IsLocalOrigin`/`IsLocalHostname` correctly parse the `Origin` header via `url.Parse` and check exact hostname / loopback IP: ```go func IsLocalOrigin(origin string) bool { if u, err := url.Parse(origin); err == nil { return IsLocalHostname(u.Hostname()) } return false } func IsLocalHostname(hostname string) bool { if "localhost" == hostname || strings.HasSuffix(hostname, ".localhost") { return true } if ip := net.ParseIP(hostname); nil != ip { return ip.IsLoopback() } return false } ``` This was tested against common bypass patterns (subdomain-suffix tricks like `localhost.attacker.com`, and `Origin: null` as sent by sandboxed iframes) and found no bypass — this is a correctly-implemented check. This means a purely remote attacker (e.g. a malicious website) cannot invoke this endpoint via CSRF; a request must originate from SiYuan's own renderer origin. ## Realistic impact Given SiYuan runs as an Electron app with `nodeIntegration: true` (per prior advisories in this repository), a same-origin script-execution primitive (e.g. an XSS bug in the renderer, of which several have been fixed in this repository recently) is typically already sufficient for direct code execution. This bug's marginal value is **persistence**: a transient XSS-driven compromise can use this endpoint to overwrite an existing, trusted, already-enabled plugin's `index.js`, converting a one-time compromise into code that runs on every future launch of the application, surviving after the original XSS vector is closed. The overwrite does not effect immediately, via this specific endpoint. `PushReloadPlugin` (the websocket event that triggers frontend hot-reload without restart) is only called from the batch-update path (`InstallBazaarPackages`, used by `batchUpdatePackage`), which explicitly checks `if petal != nil && petal.Enabled` before forcing a reload via `SetPetalEnabled`. The single-package install endpoint (`installBazaarPlugin`) does not call `PushReloadPlugin` at all — it only pushes a generic success toast. So an overwrite via this endpoint activates on the next app restart or manual plugin toggle, rather than instantly still a realistic and frequent event for a desktop application, but not an instant hot-reload. ## Suggested fix Verify that `packageName` matches the package name declared in the downloaded package's own `plugin.json`/`theme.json`/etc. before copying into `installPath`, and/or refuse to install over an existing, non-empty destination directory unless the request is explicitly an update of that same package (matching by source repo identity, not just by request-supplied name). ## Verification notes Confirmed via static source review of `kernel/api/bazaar.go`, `kernel/model/bazaar.go`, `kernel/bazaar/install.go`, `kernel/model/session.go` (CheckAuth), `kernel/util/net.go` (IsLocalOrigin/IsLocalHostname), and `kernel/model/push_reload.go` / `app/src/plugin/loader.ts` (reload trigger wiring). I do not have a running SiYuan instance in this environment to execute an end-to-end proof of concept; findings are based on tracing the actual, unmodified control flow across these files rather than assumption.

Source published

23 Oct 2026 18:38:25 UTC

Source modified

5 Nov 2026 23:25:52 UTC

Observed here

5 Nov 2026 23:38:32 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

Publisher rating · MODERATE

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin in github.com/siyuan-note/siyuan/kernel

Source published

5 Nov 2026 22:54:22 UTC

Source modified

5 Nov 2026 23:15:13 UTC

Observed here

5 Nov 2026 23:38:32 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.