A stored cross‑site scripting flaw exists in SiYuan’s marketplace rendering of bazaar READMEs. The sanitizer enabled in versions 3.6.1 to 3.6.3 does not block iframe elements, and its URL blocklist does not filter the srcdoc attribute that can carry raw HTML. A malicious bazaar package author can embed an iframe with a srcdoc containing JavaScript, which is executed inside the Electron application with full privileges when other users view the package in the marketplace UI, allowing arbitrary code execution.

The affected vendor is Siyuan Note, product SiYuan. Versions 3.6.1 through 3.6.3 are vulnerable; the fix was released in version 3.6.4. Users running those releases should verify that they have not installed any untrusted bazaar packages and should avoid opening suspicious READMEs.

The CVSS base score for this flaw is 5.3, indicating a moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalogue, so no publicly documented exploits are currently known. The attack would occur by first uploading a malicious bazaar package to the marketplace and then having other users view the package’s README. Because the payload executes with full application privileges and requires no advanced setup, the potential impact is high for any user who installs or views untrusted packages. Given the absence of an official workaround, the risk is mainly mitigated by applying the available patch.