CVE-2026-56397 json
SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
published 2026-03-16 7 mo ago modified 2026-11-08 18 h ago also CVE-2026-56395 , EUVD-2026-38163 , GHSA-v3mg-9v85-fcm7 , GO-2026-4720
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.
Patch / fix
- go github.com/siyuan-note/siyuan/kernel 0.0.0-20260317012524-fe4523fff2c8
- SiYuan SiYuan 3.6.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/siyuan-note/siyuan/kernel | <=0.0.0-20260313024916-fd6526133bb3 <0.0.0-20260317012524-fe4523fff2c8 |
0.0.0-20260317012524-fe4523fff2c8 |
Affected products
- SiYuan SiYuan
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
vendor-advisory, exploit, web, advisory
-
vulncheck.com
/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-56397
advisory
-
github.com
/siyuan-note/siyuan
package
Sources
- CVE List CVE-2026-56397
- GitHub Advisory GHSA-v3mg-9v85-fcm7
- NVD CVE-2026-56397
- OSV GO-2026-4720
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.