CVE-2026-62204: SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install
SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.4 - Configuration
Upgrade SiYuan to v3.7.4+ so the bazaar install endpoints validate that the submitted packageName matches the downloaded package content (mitigates overwriting trusted plugins via mismatched packageName and repoURL).
SiYuan bazaar install endpoints packageName vs downloaded package content validation = enforced
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs same-origin access, low privileges, and user interaction. Exploitation also has high attack complexity and requires access to the bazaar install endpoints.
Which installations are affected?
SiYuan versions before v3.7.4 are affected. The issue concerns installations where the bazaar install functionality can be used to install packages.
What is the practical impact of successful exploitation?
An attacker can overwrite an existing trusted plugin by supplying mismatched packageName and repoURL parameters. The replaced plugin can persist across application restarts.
How can I tell whether I may already be affected?
Review installed trusted plugins for unexpected replacement or content changes, especially after bazaar installation activity. Check whether the SiYuan version is earlier than v3.7.4.