Description
This record is a duplicate; use CVE-2026-56397 instead.
Published: 2026-06-21
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

This record is a duplicate; use CVE-2026-56397 instead.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install SiYuan version 3.6.1 or later, which remediates the metadata sanitization flaw.
  • Limit Bazaar marketplace usage to trusted or verified authors, or disable the marketplace entirely if not needed for your workflow.
  • Configure the Electron application to disable nodeIntegration by setting the relevant webPreferences option to false, preventing execution of injected scripts from untrusted content.

Generated by OpenCVE AI on June 21, 2026 at 16:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Thu, 17 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Title SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands. This record is a duplicate; use CVE-2026-56397 instead.
CPEs cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

 cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Mon, 22 Jun 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 21 Jun 2026 15:00:00 +0000

Type Values Removed Values Added
Description SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.
Title SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
First Time appeared B3log
B3log siyuan
Weaknesses CWE-79
CPEs cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
Vendors & Products B3log
B3log siyuan
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

B3log Siyuan
cve-icon MITRE

Status: REJECTED

Assigner: VulnCheck

Published:

Updated: 2026-09-17T16:04:58.400Z

Reserved: 2026-06-21T12:37:58.434Z

Link: CVE-2026-56395

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-06-21T14:16:26.530

Modified: 2026-09-17T17:16:44.410

Link: CVE-2026-56395

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-21T19:30:16Z

Weaknesses

No weakness.