CVE-2026-56397

CriticalCVSS 9.6/10Last modified Oct 8, 2026

Description

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 21, 2026
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-563989.0Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MI CVE-2026-563995.0Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows auth CVE-2026-56406.3A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /ad CVE-2026-564009.6open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authe CVE-2026-564026.5NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder CVE-2026-564036.9libexpat before 2.8.2 has an integer overflow in storeAtts.CVE-2026-564046.9libexpat before 2.8.2 has an integer overflow in addBinding.CVE-2026-564056.9libexpat before 2.8.2 has an integer overflow in getAttributeId.CVE-2026-564066.9libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.CVE-2026-564076.9libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.CVE-2026-564086.9libexpat before 2.8.2 has an integer overflow in copyString.CVE-2026-564096.5xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.