EUVD-2026-64270

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin...

GHSA-RPX2-P6HP-X5GJ SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...

CVE-2024-40348

CVE-2024-40348 POC for CVE-2024-40348 Bazaar v1.4.3 and prior. Will attempt to read /etc/passwd from target. Overview This is a bulk scanning and exploitation tool for CVE-2024-40348: Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal. This vulnerability was discovere...

Bazaar_poc

Bazaarpoc Bazaar v1.4.3 Arbitrary File Read Vulnerability CVE-2024-40348 python Bazaarpoc.py -h -. -. OO . OO . /. -. ,-.-'/. -. ,-.-' \ .' / | |OO\ .' / | |OO \ /\ | | \ \ /\ | | \ \ \ | | |/ \ \ | | |/ .' ,| |.' .' ,| |.' / .'. | | / .'. | | '--' '--' --' '--' '--' --' usage: Bazaarpoc.py...

CVE-2026-87812

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87812

SiYuan before v3.8.2 is affected by a stored cross-site scripting vulnerability in Bazaar package cards. The root cause is that the iconURL metadata is inserted directly into HTML img src attributes without escaping , allowing attackers to inject malicious URLs with embedded event handlers. When ...

CVE-2026-87812 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87812 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87812 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

EUVD-2026-74838

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87812: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

PT-2026-88950

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-82653

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

EUVD-2026-68239

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2026-82653

SiYuan before v3.8.1 is affected by a stored cross-site scripting (XSS) vulnerability in the confirmDialog() function. Unescaped package names and notebook names are interpolated directly into innerHTML assignments, allowing attackers to submit malicious bazaar packages with HTML/script payloads ...

CVE-2026-82653

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...