CVE-2026-56395 Overview
CVE-2026-56395 is a stored cross-site scripting (XSS) vulnerability in SiYuan, a self-hosted personal knowledge management application, affecting versions before v3.6.1. The Bazaar marketplace component fails to sanitize package metadata and README content. Malicious package authors can inject arbitrary HTML and JavaScript through the displayName, description, or README fields. Because SiYuan's Electron shell enables nodeIntegration, injected JavaScript escapes the browser sandbox and executes operating system commands. Any user browsing the Bazaar marketplace is exposed to remote code execution with no authentication required and only minimal interaction. The flaw is tracked as CWE-79.
Critical Impact
Unauthenticated attackers can publish a malicious Bazaar package and achieve remote code execution on any SiYuan user who browses the marketplace.
Affected Products
- SiYuan versions prior to v3.6.1
- SiYuan desktop builds using Electron with nodeIntegration enabled
- Any deployment exposing the Bazaar marketplace UI to users
Discovery Timeline
- 2026-06-21 - CVE-2026-56395 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-56395
Vulnerability Analysis
The vulnerability stems from missing output encoding in the Bazaar marketplace renderer. SiYuan fetches third-party package manifests and README files from an external registry and displays them directly inside the Electron renderer process. Fields including displayName, description, and the package README are rendered as HTML without sanitization. An attacker who publishes a Bazaar package can embed <script> tags or HTML event handlers in these fields. When a victim opens the marketplace view, the payload executes in the renderer context.
Electron's nodeIntegration setting elevates the impact from typical browser-context XSS to full remote code execution. With nodeIntegration enabled, injected JavaScript can call Node.js APIs such as require('child_process').exec(). This converts a stored XSS primitive into arbitrary OS command execution under the privileges of the SiYuan desktop process.
Root Cause
The root cause is improper neutralization of input during web page generation ([CWE-79]) combined with an insecure Electron configuration. Package metadata sourced from untrusted authors is concatenated into the DOM without escaping. The renderer process retains Node.js privileges, removing the defense-in-depth boundary that normally limits XSS to script-only impact.
Attack Vector
The attack is network-based and requires user interaction limited to opening the Bazaar marketplace. An attacker publishes a package containing an XSS payload in metadata or README markdown. When a SiYuan user browses the Bazaar, the renderer parses the malicious content and executes the payload. The payload then uses Node.js APIs to spawn processes, read files, or establish persistence.
No authentication on the victim side is required. See the GitHub Security Advisory and the VulnCheck Remote Code Execution Advisory for additional technical detail.
Detection Methods for CVE-2026-56395
Indicators of Compromise
- Unexpected child processes spawned by the SiYuan Electron process, such as cmd.exe, powershell.exe, sh, or bash.
- Outbound network connections from the SiYuan binary to non-Bazaar hosts shortly after the marketplace view is opened.
- New files written under user profile directories by the SiYuan process immediately following Bazaar browsing activity.
Detection Strategies
- Hunt for process trees where SiYuan.exe or the Electron binary is the parent of shell interpreters or scripting hosts.
- Inspect Bazaar package manifests for HTML tags, <script> elements, or JavaScript URI schemes inside displayName, description, and README fields.
- Correlate endpoint telemetry with installed SiYuan versions to identify hosts running builds prior to v3.6.1.
Monitoring Recommendations
- Log and alert on command-line executions whose parent process is the SiYuan or Electron renderer.
- Monitor DNS and HTTP traffic from SiYuan clients to the Bazaar registry and flag responses containing scriptable content.
- Track SiYuan version inventory across endpoints to prioritize patching of vulnerable installations.
How to Mitigate CVE-2026-56395
Immediate Actions Required
- Upgrade all SiYuan installations to v3.6.1 or later, where Bazaar metadata and README content are sanitized before rendering.
- Restrict end-user ability to browse or install Bazaar packages until the patched version is deployed.
- Audit recently installed Bazaar packages and remove any from untrusted authors.
Patch Information
The vendor fixed the issue in SiYuan v3.6.1. The patched release sanitizes Bazaar package metadata and README HTML before rendering. Refer to the GitHub Security Advisory GHSA-v3mg-9v85-fcm7 for the official fix details and release notes.
Workarounds
- Block network access from SiYuan clients to the Bazaar registry until upgrades are completed.
- Run SiYuan under a least-privilege user account to limit the blast radius of any successful exploitation.
- Avoid opening the Bazaar marketplace view on vulnerable versions, and disable any auto-update or auto-browse features that load remote package content.
# Verify the installed SiYuan version is patched
siyuan --version
# Expected output: 3.6.1 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
