CVE-2026-56397: SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56397?
CVE-2026-56397 has a severity rating of critical with a score of 9.6.
How do I fix CVE-2026-56397?
To fix CVE-2026-56397, upgrade to SiYuan version 3.6.1 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2026-56397?
CVE-2026-56397 is a remote code execution vulnerability that arises from improper sanitization of package metadata in SiYuan.
Who is affected by CVE-2026-56397?
Any user of SiYuan prior to version 3.6.1 who accesses the Bazaar marketplace is potentially affected by CVE-2026-56397.
What can attackers achieve with CVE-2026-56397?
Attackers can achieve remote code execution by injecting malicious HTML and JavaScript into the Bazaar via manipulated package metadata.