CVE-2026-45375 - Vulnerability Analysis

Overview

SiYuan < 3.7.0 contains a stored XSS caused by lack of HTML escaping in the name and version fields of plugin.json and similar files in the Bazaar marketplace, letting attackers execute arbitrary scripts when users open the marketplace tab, exploit requires user to open the marketplace UI.

Severity & Score

Impact

Attackers can execute arbitrary scripts in users' browsers, potentially stealing data or performing actions on behalf of the user.

Mitigation

Update to version 3.7.0 or later.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-27qc-m5gf-jv5r

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner