Skip to content
Sign in
9.4 Critical

CVE-2026-56397 SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

Description

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
Active
Confidentiality
High
Integrity
High
Availability
High
Confidentiality of other systems
High
Integrity of other systems
High
Availability of other systems
High

Affected products and versions

Product Affected versions Fixed in
SiYuan 3.6 earliest → < 3.6.1 3.6.1

Other CVEs of SiYuan

The 7 CVEs of SiYuan →
CVE-2026-56395 SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious… 9.4 Critical CVE-2024-53504 A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory 9.8 Critical CVE-2024-53505 A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent 9.8 Critical CVE-2024-53506 A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs 9.8 Critical
Track this CVE