Popis
SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan-s Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan-s Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.
CVSS 8.3EPSS 0.307%Riziko 0.85
Zobraziť zdroj- Zverejnené
- 2026-05-14 19:16:37
- Dotknuté verzie
- >=2.1.12,<3.7.0
- Typ
- Core software
- Vektor
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H