CVE-2026-54070: SiYuan stored XSS in Bazaar marketplace package README

Executive brief

SiYuan is a personal knowledge management system. A vulnerability in its marketplace allows a malicious package author to execute arbitrary code in a user's browser when they view a package's description. This could allow an attacker to steal sensitive access tokens, take over the user's workspace, or gain control over the underlying server.

Technical details

A stored XSS vulnerability exists in SiYuan's Bazaar marketplace component. The 'lute' Markdown engine used to render package READMEs employs an attribute denylist for sanitization that omits modern HTML event handlers such as 'onpointerover' and 'onbeforetoggle'. When an administrator views a malicious package listing, the frontend assigns this unsanitized HTML to 'innerHTML' without further purification. Because the application lacks a Content Security Policy (CSP) and other security headers, these handlers execute when triggered by user interaction (e.g., hovering over an element). An attacker can use this to steal the kernel API token and achieve remote code execution via the plugin installation API. The issue is fixed in version 0.0.0-20260628153353-2d5d72223df4.

Affected products

• siyuan-note SiYuan <= 3.6.5

Timeline

• 2026-04-21: other: Last vulnerable version 3.6.5 released
• 2026-06-24: disclosed: NVD publication date
• 2026-06-28: patched
• 2026-07-10: advisory

References

• https://api.github.com/users/kah-ja
• https://github.com/kah-ja
• https://api.github.com/users/kah-ja/gists%7B/gist_id%7D
• https://api.github.com/users/kah-ja/repos
• https://avatars.githubusercontent.com/u/36455663?v=4
• https://api.github.com/users/kah-ja/events%7B/privacy%7D