CVE-2026-56397 Details
Description
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.
A remote code execution vulnerability has been identified in SiYuan versions prior to 3.6.1. The issue arises because the application fails to properly sanitize package metadata and README content in the Bazaar marketplace. This lack of sanitization allows malicious package authors to inject arbitrary HTML and JavaScript. When users browse the Bazaar, these injected scripts can execute, exploiting Electron's nodeIntegration setting to run OS commands. The vulnerability is present in the metadata rendering and README rendering processes, both in the backend and frontend.
Users can update to SiYuan version 3.6.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 21, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2 | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= 3.5.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 21, 2026 | New CVE Received | [email protected] |