CVE-2026-56395 | SiYuan before v3.6.1 fails to sanitize package metadata and … | CVSS 9.6 CRITICAL

Description

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Metadata

CVE ID: CVE-2026-56395
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-21 12:37 UTC
Published: 2026-06-21 13:27 UTC
Last updated: 2026-06-21 13:27 UTC
Primary CWE: CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product: SiYuan / SiYuan
Sources: cve.org · NVD

Severity & Metrics

9.6 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
SiYuan	SiYuan	—	0 < 3.6.1, 3.6.1

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.6	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.4	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (2)

GHSA Advisory GHSA-v3mg-9v85-fcm7 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
VulnCheck Advisory: SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme