[ CVE-2026-62204 · Published 22 Aug 2026 ]
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
CVSS 6.6
EPSS <1%Fix available
[ Description ]Official description
SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.
[ Fixes ]Fixes and patches
- github.com/siyuan-note/siyuan/kernel 0.0.0-20260808010544-26ccb40d390eFixed version · GitHub Advisories · go package github.com/siyuan-note/siyuan/kernel: upgrade to 0.0.0-20260808010544-26ccb40d390e or later (affected < 0.0.0-20260808010544-26ccb40d390e)
[ Packages ]Affected open-source packages
- github.com/siyuan-note/siyuan/kernel goAffected < 0.0.0-20260808010544-26ccb40d390e · fixed in 0.0.0-20260808010544-26ccb40d390e · GHSA-rpx2-p6hp-x5gj