CVE-2026-56397CWE-79cross-site-scripting

CVE-2026-56397

Critical · published June 21, 2026

CVSS v3.1

9.6

EPSS

Percentile

41.7

In the wild

Unconfirmed

What it is

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

The record

Technical detail

CVSS v3.1: 9.6 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00496 · 41.7th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-06-21T18:16Z

References (3)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7 · [email protected]https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2 · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

21 JUN 13:27Z
SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
cvelistv5