Executive brief
SiYuan is a desktop note-taking application that allows users to install plugins and themes through its built-in marketplace. The application fails to verify that the requested plugin name matches the actual content being downloaded, allowing an attacker with local network access to silently overwrite legitimate, trusted plugins with malicious code. This compromised plugin then persists across application restarts, giving attackers a foothold for ongoing code execution.
Technical details
The vulnerability is an insufficient verification of data authenticity (CWE-345) in the bazaar package installation endpoints. The installBazaarPlugin API accepts packageName, repoURL, and repoHash as independent request parameters without cross-validation. While packageName determines the installation destination directory (derived via getPackageInstallPath), repoURL and repoHash determine the downloaded content; no consistency check ensures they refer to the same package. An attacker with same-origin access (typically via XSS in the renderer) can invoke the endpoint with a legitimate plugin's packageName paired with attacker-controlled repoURL/repoHash parameters, silently overwriting the trusted plugin's files. The vulnerability requires same-origin access due to a correctly-implemented Origin header validation, making it primarily valuable for persisting transient compromises rather than enabling pure remote attacks. The overwrite takes effect on next application restart or manual plugin toggle, not immediately.
Affected products
- SiYuan SiYuan before v3.7.4
Timeline
- 2026-08-22: disclosed
- 2026-08-22: patched: Fixed in v3.7.4