CVE Intelligence
Analysis AI-assisted

CVE-2026-45375: SiYuan Bazaar Cross-Site Scripting via Unescaped Package Name and Version Fields

SiYuan's Bazaar community marketplace renders the name and version fields of package manifests into the Settings Marketplace interface without HTML escaping, which enables cross-site scripting. The CNA rates the issue critical with a CVSS 3.1 base score of 9. The sources state the issue is fixed in 3.7.0, and the record does not list it in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SiYuan is an open-source personal knowledge management system. The issue affects its Bazaar community marketplace, where package metadata is shown in the Settings Marketplace interface. According to the description, the name and version fields of package manifests (plugin, theme, template, widget and icon manifests) are inserted into HTML without escaping.

Impact

  • Malicious HTML placed in the name or version field of a package manifest can be parsed and executed when a user opens the marketplace tab.
  • The CNA records a CVSS 3.1 base score of 9 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.
  • The vector indicates network attack, low privileges, user interaction, scope change and high impact to confidentiality, integrity and availability.

Affected products and versions

  • SiYuan versions prior to 3.7.0, as stated in the description.
  • The structured affected list in the record is empty, so no further version detail is available from the record.

Exploitation status

  • The record shows the CVE is not listed in CISA KEV.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is recorded as 0.00413 with a percentile of 0.33827.

Remediation and mitigation

  • Upgrade SiYuan to version 3.7.0 or later, which the description identifies as the fixed release.
  • Until the upgrade is applied, avoid installing marketplace packages from unfamiliar sources and avoid opening the marketplace tab in sensitive environments.
  • Review the source of any third-party package before enabling it.

Detection guidance

  • Review installed plugin, theme, template, widget and icon manifests for unexpected markup characters in the name and version fields.
  • Check marketplace package sources and recent package installations for entries from untrusted authors.
  • Consult the GitHub security advisory for the vendor's own description.

Limitations of the available information

  • The record has no title, so the titles here were written from the description.
  • The record's source status is Deferred and the structured affected and fixed fields are empty.
  • The sources consulted do not describe real-world attacks, affected deployments or exploit prevalence.
  • Details of the vendor's patch beyond the 3.7.0 version are not in the record.
  • The full NVD entry was listed as a source page, but its content beyond the record is not reviewed here.

Frequently asked questions

Which SiYuan versions are affected?

According to the description, versions prior to 3.7.0 are affected. The structured affected list in the record is empty, so no further version range is confirmed.

Is this CVE known to be exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should users do?

Upgrade to SiYuan 3.7.0 or later and review any third-party marketplace packages before installing or enabling them.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.