CVE-2026-62204

SiYuan versions before v3.7.4 contain a plugin overwrite vulnerability in the bazaar install endpoints . The root cause is a failure to validate that the packageName parameter matches the actual downloaded package content. An attacker with same-origin access can supply mismatched packageName and ...