CVE-2026-45375Disclosure

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) renders the name and version fields of a package's plugin.json (and the equivalent theme.json / template.json / widget.json / icon.json) into the Settings → Marketplace UI without HTML escaping. The kernel-side helper sanitizePackageDisplayStrings in kernel/bazaar/package.go HTML-escapes only Author, DisplayName, and Description — Name and Version flow through to the renderer raw. The frontend at app/src/config/bazaar.ts substitutes them into HTML template strings via ${item.preferredName} / ${data.name} / v${data.version} and assigns the result to innerHTML. As a consequence, malicious HTML in either field is parsed and executed when a user opens the marketplace tab. This vulnerability is fixed in 3.7.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79CWE-116

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-05-13); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets1 URL

By indicator

http://github.com/siyuan-note/siyuan/kernel

Classification over time

Date	Total	Labels

2026-05-13	1	Disclosure1
2026-06-18	1	General1

Full discourse2 posts

Upwind Security MDR@UpwindMDR147d
Disclosure
🚨 High - SiYuan Marketplace Stored XSS → RCE (CVE-2026-45375) A critical stored XSS in SiYuan's Bazaar marketplace allows attackers to inject malicious HTML via unsanitized name and version fields in package metadata. Because the Electron desktop client runs with nodeIntegration: true and contextIsolation: false, the XSS escalates to arbitrary OS command execution the moment a user opens the marketplace tab — no install action required. 👉 Affected: http://github.com/siyuan-note/siyuan/kernel ≤ 0.0.0-20260421031503-96dfe0bea474 | No patch available
Post summary
A high‑severity stored XSS in SiYuan's Bazaar marketplace leads to RCE via unsanitized metadata, with no patch available and no PoC or exploit tools referenced, and no evidence of active exploitation.
00020100
187 followersView on X
Joey Romaine 🇺🇸 |=★=|@Tank23x0111d
General
CVE-2026-45375 is a good patch-discipline check. Affected systems / vulnerability. Public details are enough to start scoping. What would you check first if this hit your stack?
Post summary
The post merely mentions CVE‑2026‑45375 as a prompt for patch checks, offering no technical, exploit, or remediation specifics.
1000055
337 followersView on X

Explore more

Back to dashboard