SiYuan’s Bazaar marketplace displays package author metadata directly in the application’s HTML without proper escaping. When a malicious package includes harmful author fields, the data is persisted as a stored XSS vector. Because the Electron renderer windows are created with nodeIntegration enabled and contextIsolation disabled, the XSS payload gains access to Node.js APIs and can execute arbitrary code on the user’s machine, resulting in remote code execution. The vulnerability originates from CWE‑79 (Unvalidated HTML or Script Injection) and amplification via CWE‑94 (Improper Control of Generation of Code).

The affected builds are all SiYuan releases from version 2.1.12 up to, but not including, 3.7.0. Users who have installed or viewed packages in the Bazaar marketplace during this period are potentially exposed. No earlier or later versions are impacted.

With a CVSS score of 8.3 this flaw is categorized as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploit today. Nevertheless, the attack path is straightforward: any user who visits or installs a malicious package will trigger the stored XSS, allowing the attacker to run Node.js code because of the insecure Electron configuration. The consequence is full control over the host system.