GO-2026-4720

vendorUSosv

SiYuan vulnerable to remote code execution via marketplace XSS in github.com/siyuan-note/siyuan/kernel

Advisory ansehen veröffentlicht 2026-08-19Lizenz: per source

SiYuan vulnerable to remote code execution via marketplace XSS in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/siyuan-note/siyuan/kernel before v3.6.1.

beschreibt (2)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-56397US	—	0.50% (42nd)	—	2026-06-21
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. At…
CVE-2026-56395US	—	0.70% (52nd)	—	2026-06-21
Rejected reason: This record is a duplicate; use CVE-2026-56397 instead.

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7ADVISORY

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan