PT-2026-51238 · Siyuan · Siyuan

0Xkakash1 · Publicado 2026-06-21 · Atualizado 2026-06-21 · CVE-2026-56397

NVD

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-56397

Produtos afetados

Siyuan

Referências · 3

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-56397 · Nota de Segurança
• https://vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2 · Nota