CVE-2026-56397
SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
CVSS Score
9.6
EPSS Score
0.0%
EPSS Percentile
0th
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.
| CWE | CWE-79 |
| Vendor | siyuan |
| Product | siyuan |
| Published | Jun 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for siyuan siyuan
Be the first to know when new critical vulnerabilities affecting siyuan siyuan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
SiYuan / SiYuan
0 < 3.6.1
References
Credits
🔍 0xkakash1