CVE-2026-56395: SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

Synopsis

A cross-site scripting (XSS) to remote code execution vulnerability affects SiYuan, a note-taking application built on Electron, in versions before 3.6.1. The vulnerability is reachable over the network and requires no authentication; a user must browse the Bazaar marketplace while a malicious package is listed there. Successful exploitation gives the attacker full remote code execution on the victim's host by abusing Electron's nodeIntegration setting to run arbitrary OS commands. A patched-image rebuild at version 3.6.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must serve a malicious Bazaar package reachable over the internet; the victim's SiYuan client fetches and renders the payload when browsing the marketplace.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated attacker can publish a malicious package to the Bazaar marketplace.

• Victim interactionRequired

  The victim must open the Bazaar marketplace in SiYuan and browse to or load a listing that contains the injected XSS payload.

• Attack complexityDetail

  The exploit is reliable and condition-free once the malicious package is listed; no race conditions or special memory-layout requirements are involved.

Blast Radius

• Attacker executes arbitrary OS commands on the victim's host via Electron's nodeIntegration, gaining full control of the local process.
• All files and credentials accessible to the SiYuan process can be read, exfiltrated, or destroyed.
• The attacker can modify persisted notes, configuration files, and any data stored in the SiYuan workspace.
• Compromise extends beyond the local system boundary because the CVSS v4.0 vector records high impact on subsequent-system confidentiality, integrity, and availability, meaning lateral movement or supply-chain abuse is within scope.