PT-2026-51236 · Siyuan · Siyuan

0Xkakash1 · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56395

NVD

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56395

Affected Products

Siyuan

References · 3

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56395 · Security Note
• https://vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme · Note