SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata
Date: 2026-03
Affected: go/github.com/siyuan-note/siyuan/kernel
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-33067
CWE: CWE-79

# Stored XSS to RCE via Unsanitized Bazaar Package Metadata ## Summary SiYuan's Bazaar (community marketplace) renders package metadata fields (`displayName`, `description`) using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fields, which executes automatically when any user browses the Bazaar page. Because SiYuan's Electron configuration enables `nodeIntegration: true` with `contextIsolation: false`, this XSS escalates directly to full Remote Code Execution on the victim's operating system — with zero user interaction beyond opening the marketplace tab. ## Affected Component - **Metadata rendering**: `app/src/config/bazaar.ts:275-277` - **Electron config**: `app/electron/main.js:422-426` (`nodeIntegration: true`, `contextIsolation: false`) ## Affected Versions - SiYuan <= 3.5.9 ## Severity **Critical** — CVSS 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CWE-79: Improper Neutralization of Input During Web Page Generation (Stored XSS) ## Vulnerable Code In `app/src/config/bazaar.ts:275-277`, package metadata is injected directly into HTML templates without escaping: ```typescript // Package name injected directly — NO escaping ${item.preferredName}${item.preferredName !== item.name ? ` <span class="ft__on-surface ft__smaller">${item.name}</span>` : ""} // Package description — title attribute uses escapeAttr(), but text content does NOT <div class="b3-card__desc" title="${escapeAttr(item.pre


Mitigations:

Architectural layers (MAESTRO):