Executive brief
SiYuan is a popular note-taking and personal knowledge management application. The Bazaar feature allows users to discover and install third-party themes and plugins. A vulnerability in this marketplace allows attackers to inject malicious code through manipulated package metadata that executes in users' browsers when they view Bazaar listings, potentially compromising user data and enabling unauthorized actions within the application.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Bazaar package card rendering functionality. The iconURL metadata field from marketplace packages is inserted directly into HTML img src attributes without sanitization (app/src/config/bazaar.ts:612-618), allowing attackers to break out of the src attribute and inject event handlers like onerror. The vulnerable code path includes the Bazaar API and model layers (kernel/api/bazaar.go, kernel/model/bazaar.go) which forward metadata without rewriting the iconURL field. An authenticated user viewing a malicious or compromised marketplace listing triggers the XSS, enabling same-origin API requests and application state manipulation. The fix involves URL scheme validation, HTML attribute encoding via escapeAttr, and preferably DOM API construction with safe URL allowlists. Patches are available in SiYuan v3.8.2 and later.
Affected products
- SiYuan SiYuan before 3.8.2
Timeline
- 2026-08-26: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: v3.8.2 released