What is GHSA-24r3-p3x6-cqvx?

GHSA-24r3-p3x6-cqvx is a security advisory published by GitHub Security Advisories with Critical severity. SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar...

Which CVE IDs does GHSA-24r3-p3x6-cqvx cover?

GHSA-24r3-p3x6-cqvx covers the following CVE IDs: CVE-2026-56397. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-24r3-p3x6-cqvx?

GHSA-24r3-p3x6-cqvx has a CVSS v3 base score of 9.6, published by GitHub Security Advisories.

GHSA-24r3-p3x6-cqvxCriticalCVSS 9.6

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar...

Vendor

GitHub Security Advisories

Published

June 21, 2026

Last Modified

June 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-56397 →

📋 Description

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v3mg-9v85-fcm7
https://nvd.nist.gov/vuln/detail/CVE-2026-56397
https://www.vulncheck.com/advisories/siyuan-remote-code-execution-via-malicious-bazaar-package-metadata-and-readme-2
https://github.com/advisories/GHSA-24r3-p3x6-cqvx