Description
SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | < 3.7.4 | 3.7.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | < 0.0.0-20260808010544-26ccb40d390e | 0.0.0-20260808010544-26ccb40d390e | GHSA-rpx2-p6hp-x5gj |
References
- GitHub Security Advisory (GHSA-rpx2-p6hp-x5gj) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install third-party-advisory