PT-2026-42383

🗓️ 20 May 2026 00:00:00Reported by Positive TechnologiesType

Siyuan Bazaar stores unescaped package name and version, enabling stored cross site scripting and Electron code execution.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-45375	10 May 202615:32	–	circl
CNNVD	SiYuan 跨站脚本漏洞	14 May 202600:00	–	cnnvd
CVE	CVE-2026-45375	14 May 202618:13	–	cve
Cvelist	CVE-2026-45375 SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution	14 May 202618:13	–	cvelist
EUVD	EUVD-2026-30356	14 May 202618:13	–	euvd
Github Security Blog	SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution	13 May 202615:33	–	github
NVD	CVE-2026-45375	14 May 202619:16	–	nvd
OSV	GHSA-27QC-M5GF-JV5R SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution	13 May 202615:33	–	osv
OSV	GO-2026-5001 SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution in github.com/siyuan-note/siyuan/kernel	20 May 202619:07	–	osv
Positive Technologies	PT-2026-40730	13 May 202600:00	–	ptsecurity

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45375
osv	www.osv.dev/vulnerability/GO-2026-5001
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-27qc-m5gf-jv5r