GHSA-v3mg-9v85-fcm7: SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS
Remote Code Execution via Malicious Bazaar Package — Marketplace XSSSummarySiYuan's Bazaar (community marketplace) renders plugin/theme/template metadata and README content without sanitization. A malicious package author can achieve RCE on any user who browses the Bazaar by:**Package metadata XSS (zero-click):** Package `displayName` and `description` fields are injected directly into HTML via template literals without escaping. Just loading the Bazaar page triggers execution.**README XSS (one-click):** The `renderREADME` function uses `lute.New()` without `SetSanitize(true)`, so raw HTML in the README passes through to `innerHTML` unsanitized.Both vectors execute in Electron's renderer with `nodeIntegration: true` and `contextIsolation: false`, giving full OS command execution.Affected Component**Metadata rendering:** `app/src/config/bazaar.ts:275-277`**README rendering (backend):** `kernel/bazaar/package.go:635-645` (`renderREADME`)**README rendering (frontend):** `app/src/config/bazaar.ts:607` (`innerHTML`)**Electron config:** `app/electron/main.js:422-426` (`nodeIntegration: true`)**Version:** SiYuan <= 3.5.9Vulnerable CodeVector 1: Package metadata — no HTML escaping (bazaar.ts:275-277)Note: The `title` attribute uses `escapeAttr()`, but the actual text content does not — inconsistent escaping.Vector 2: README rendering — no Lute sanitization (package.go:635-645)Compare with the SiYuan note renderer in `kernel/util/lute.go:81`:Frontend innerHTML injection (bazaar.ts:607)Proof of ConceptVector 1: Malicious package manifest (zero-click RCE)A malicious `plugin.json` (or `theme.json`, `template.json`):When any user opens the Bazaar page and this package is in the listing, the `onerror` handler fires automatically (since `src=x` fails to load), executing arbitrary OS commands.Vector 2: Malicious README.md (one-click RCE)When a user clicks on the package to view its README, the raw HTML is rendered via `innerHTML` without sanitization, executing the `onerror` handler.Reverse shell via READMEData exfiltration via package nameAttack ScenarioAttacker creates a GitHub repository with a plugin/theme/templateAttacker submits it to the SiYuan Bazaar (community marketplace)Package manifest contains XSS payload in `displayName` or `description`**Zero-click:** When ANY user browses the Bazaar, the package listing renders the malicious name/description → JavaScript executes → RCE**One-click:** If the package README also contains raw HTML, clicking to view details triggers additional payloadsThe attacker doesn't need to trick the user into installing anything. Simply browsing the marketplace is enough.Impact**Severity:** CRITICAL (CVSS 9.6)**Type:** CWE-79 (Improper Neutralization of Input During Web Page Generation)Full remote code execution via Electron's `nodeIntegration: true`Zero-click for metadata XSS — triggers on page loadSupply-chain attack vector targeting all Bazaar usersCan steal API tokens, session cookies, SSH keys, arbitrary filesCan install persistence, backdoors, or ransomwareAffects all SiYuan desktop users who browse the BazaarSuggested Fix1. Escape package metadata in template rendering (bazaar.ts)2. Enable Lute sanitization for README rendering (package.go)3. Long-term: Harden Electron configuration
CVSS v4.0: 5.3