Description
SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan-s Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan-s Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.
CVSS 8.3EPSS 0.307%Risque 0.85
Voir la source- Publication
- 2026-05-14 19:16:37
- Versions concernées
- >=2.1.12,<3.7.0
- Type
- Core software
- Vecteur
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H