critical9.6
CVE-2026-56397
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HT…
Impact
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/siyuan-note/siyuan/kernel | <= 0.0.0-20260313024916-fd6526133bb3 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| SiYuan | before 3.6.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
- https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2
- https://github.com/advisories/GHSA-v3mg-9v85-fcm7
- https://nvd.nist.gov/vuln/detail/CVE-2026-56397