CVE-2026-45375

🗓️ 14 May 2026 18:13:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 42 Views🌐 WEB

CVE-2026-45375: SiYuan Bazaar renders unescaped package name and version, enabling XSS pre-3.7.0.

Reporter	Title	Published	Views	Family All 19
Circl	CVE-2026-45375	10 May 202615:32	–	circl
CNNVD	SiYuan cross-site scripting vulnerabilities	14 May 202600:00	–	cnnvd
Cvelist	CVE-2026-45375 SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution	14 May 202618:13	–	cvelist
Cvelist	CVE-2026-55570 SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)	24 Jun 202621:24	–	cvelist
EUVD	EUVD-2026-30356	14 May 202618:13	–	euvd
Github Security Blog	SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution	13 May 202615:33	–	github
Mend	CVE-2026-45375	14 May 202618:13	–	mend
NVD	CVE-2026-45375	14 May 202619:16	–	nvd
osv_ghsa	GHSA-27QC-M5GF-JV5R SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution	13 May 202615:33	–	osv_ghsa
osv_go	GO-2026-5001 SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution in github.com/siyuan-note/siyuan/kernel	20 May 202619:07	–	osv_go

Vulners

Node

b3log siyuanRange≤3.6.5

[
  {
    "vendor": "siyuan-note",
    "product": "siyuan",
    "versions": [
      {
        "version": "<= 3.6.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-27qc-m5gf-jv5r

Parameter	Position	Path	Description	CWE
item.preferredName	nested	/Settings	The Marketplace UI in the Settings tab renders the 'name' and 'version' fields from plugin.json, theme.json, template.json, and icon.json files without HTML escaping, allowing for XSS via innerHTML.	CWE-116, CWE-79
data.name	nested	/Settings	The Marketplace UI in the Settings tab renders the 'name' and 'version' fields from plugin.json, theme.json, template.json, and icon.json files without HTML escaping, allowing for XSS via innerHTML.	CWE-116, CWE-79
data.version	nested	/Settings	The Marketplace UI in the Settings tab renders the 'name' and 'version' fields from plugin.json, theme.json, template.json, and icon.json files without HTML escaping, allowing for XSS via innerHTML.	CWE-116, CWE-79

17 Jun 2026 10:51Current

8.2High risk

Vulners AI Score8.2

CVSS 3.19

EPSS0.00413

SSVC