363 matches found
SUSE CVE-2026-54070
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only...
CVE-2026-66395
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
CVE-2026-66395
SiYuan Desktop before v3.7.2 is affected by a reflected XSS in the bazaar plugin readme handler that enables RCE via a crafted siyuan:// deep link. An attacker can inject HTML payloads through the plugin name parameter, which render with insertAdjacentHTML in an insecure Electron renderer and gra...
CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
CVE-2026-66395
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
CVE-2026-66395
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
EUVD-2026-49328
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
PT-2026-64996
Name of the Vulnerable Software and Affected Versions SiYuan desktop versions prior to 3.7.2 Description A reflected cross-site scripting issue exists in the bazaar plugin readme handler. An attacker can execute arbitrary code by crafting a malicious siyuan:// deep link. By injecting HTML payload...
CVE-2026-66395: Improper Neutralization of Input During Web Page Generation
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
GO-2026-5965 SiYuan: Stored XSS in Bazaar marketplace via package README event handlers in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers in github.com/siyuan-note/siyuan/kernel...
aiq-platform-api (>=1.0.17, <=1.0.57), archive-to-images (1.0.0) +24 more potentially affected by CVE-2026-44722 via pyzipper (>=0.3.5, <=0.3.6)
pyzipper PYPI version =0.3.5, =1.0.17, =0.1.5, =1.0.0, =0.0.1, =0.1.2, =1.3.5.5, =1.2.1, =0.0.1, =1.0.1, =0.0.11, =1.0.17 - jsw-jzyunqi 1.0.5 and more Source cves: CVE-2026-44722 Source advisory: MEND:CVE-2026-44722...
[SECURITY] Fedora 44 Update: breezy-3.3.21-2.fc44
Breezy brz is a decentralized revision control system, designed to be easy for developers and end users alike. By default, Breezy provides support for both the Bazaar and Git file formats...
aiq-platform-api (>=1.0.17, <=1.0.57), archive-to-images (1.0.0) +24 more potentially affected by CVE-2026-44722 via pyzipper (>=0.3.5, <=0.3.6)
pyzipper PYPI version =0.3.5, =1.0.17, =0.1.5, =1.0.0, =0.0.1, =0.1.2, =1.3.5.5, =1.2.1, =0.0.1, =1.0.1, =0.0.11, =1.0.17 - jsw-jzyunqi 1.0.5 and more Source cves: CVE-2026-44722 Source advisory: OSV:PYSEC-2026-3044...
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
Summary renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only attribute names present in a fixed eventAttrs map copied from the w3schoo...
GHSA-W7CG-WHH7-XP28 SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
Summary renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only attribute names present in a fixed eventAttrs map copied from the w3schoo...
EUVD-2026-39126
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers...
CVE-2026-59833
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with sanitization enabled, but Lute's dangerous javascript scheme block does not check form action or SVG xlink:href attributes, allowing stored...
EUVD-2026-42743
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with sanitization enabled, but Lute's dangerous javascript scheme block does not check form action or SVG xlink:href attributes, allowing stored...
CVE-2026-59833: Improper Neutralization of Input During Web Page Generation
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with sanitization enabled, but Lute's dangerous javascript scheme block does not check form action or SVG xlink:href attributes, allowing stored...