Back Mondoo

CVE-2026-56395

Mondoo • June 23, 2026

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in SiYuan Bazaar Exposes Users to Malicious Packages SiYuan disclosed CVE-2026-56395, a critical remote code execution vulnerability affecting versions before 3.6.1. The flaw arises from improper sanitization of Bazaar marketplace package metadata, allowing malicious authors to inject HTML and JavaScript. This can lead to cross-site scripting and, due to Electron's nodeIntegration, execution of OS commands on victim devices. The vulnerability has a CVSS score of 9.6 (v3.1) and 9.4 (v4.0). Users are advised to upgrade to SiYuan version 3.6.1 or later and avoid untrusted packages. CVE-2026-56397 was also published with similar details, indicating a broader issue within the Bazaar marketplace. 5 sources 73

Extracted Entities

CVE-2026-56395

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)