SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS
Date: 2026-03
Affected: go/siyuan
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-79

# Remote Code Execution via Malicious Bazaar Package — Marketplace XSS ## Summary SiYuan's Bazaar (community marketplace) renders plugin/theme/template metadata and README content without sanitization. A malicious package author can achieve RCE on any user who browses the Bazaar by: 1. **Package metadata XSS (zero-click):** Package `displayName` and `description` fields are injected directly into HTML via template literals without escaping. Just loading the Bazaar page triggers execution. 2. **README XSS (one-click):** The `renderREADME` function uses `lute.New()` without `SetSanitize(true)`, so raw HTML in the README passes through to `innerHTML` unsanitized. Both vectors execute in Electron's renderer with `nodeIntegration: true` and `contextIsolation: false`, giving full OS command execution. ## Affected Component - **Metadata rendering:** `app/src/config/bazaar.ts:275-277` - **README rendering (backend):** `kernel/bazaar/package.go:635-645` (`renderREADME`) - **README rendering (frontend):** `app/src/config/bazaar.ts:607` (`innerHTML`) - **Electron config:** `app/electron/main.js:422-426` (`nodeIntegration: true`) - **Version:** SiYuan <= 3.5.9 ## Vulnerable Code ### Vector 1: Package metadata — no HTML escaping (bazaar.ts:275-277) ```typescript // Package name injected directly into HTML template — NO escaping ${item.preferredName}${item.preferredName !== item.name ? ` <span class="ft__on-surface ft__smaller">${item.name}</span>` : ""} // Package descriptio


Mitigations:

Architectural layers (MAESTRO):