by Kastro
Paper/Archive/CVE-2026-56397

CVE-2026-56397

SiYuan SiYuan — SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

EPSS 0.5%public exploitCVSS 9.6
critical.is priorityof 100
47
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 42.5.425 × 208.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Affected

ProductAffectedFixed inSource
SiYuan< 3.6.13.6.1CNA

Scores by source

VulnCheck (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7writeupvulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2