This record is a duplicate; use CVE-2026-56397 instead.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-56395 · Microsoft / collected KEV context

CVE-2026-56397 · Microsoft / collected KEV context

EUVD-2026-38161

GHSA-9f8r-gfgq-cjhm

EUVD-2026-38163

GHSA-24r3-p3x6-cqvx

GHSA-v3mg-9v85-fcm7

GO-2026-4720

cve-program · CVE-2026-56395

cve-program · CVE-2026-56397

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
• https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2

euvd · EUVD-2026-38161

euvd · EUVD-2026-38163

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
• https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2

nvd · CVE-2026-56395

nvd · CVE-2026-56397

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
• https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2

osv · GHSA-24r3-p3x6-cqvx

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
• https://nvd.nist.gov/vuln/detail/CVE-2026-56397
• https://github.com/siyuan-note/siyuan
• https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2

osv · GHSA-v3mg-9v85-fcm7

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
• https://nvd.nist.gov/vuln/detail/CVE-2026-56397
• https://github.com/siyuan-note/siyuan
• https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2

osv · GO-2026-4720

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7

No related operational record is retained in the current change model.