9.4
Critical
CVE-2026-56395 SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious…
Description
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SiYuan 3.6 | earliest → < 3.6.1 | 3.6.1 |
Other CVEs of SiYuan
The 7 CVEs of SiYuan →
CVE-2026-56397
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious…
9.4
Critical
CVE-2024-53504
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory
9.8
Critical
CVE-2024-53505
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent
9.8
Critical
CVE-2024-53506
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs
9.8
Critical