CVE-2026-56395

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-56395
Rejected reason: This record is a duplicate; use CVE-2026-56397 instead.
CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

17 Sep 2026, 17:16

Type Values Removed Values Added
References
  • {'url': 'https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}
  • {'url': 'https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme', 'source': 'disclosure@vulncheck.com'}
CWE CWE-79
Summary (en) SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands. (en) Rejected reason: This record is a duplicate; use CVE-2026-56397 instead.
CVSS v2 : unknown
v3 : 9.6 		v2 : unknown
v3 : unknown
Information

Published : 2026-06-21 14:16

Updated : 2026-09-17 17:16

NVD link : CVE-2026-56395

Mitre link : CVE-2026-56395

CVE.ORG link : CVE-2026-56395

JSON object : View

Products Affected

No product.

CWE

No CWE.