CVE-2026-54070: SiYuan Marketplace README XSS Leads to Admin Workspace Compromise

Technical summary

The vulnerability stems from an incomplete HTML sanitization implementation in the Bazaar package README renderer (kernel/bazaar/readme.go). SiYuan uses the lute Markdown engine with SetSanitize(true), which relies on an event-handler blocklist (allowAttr) derived from a legacy w3schools handler list. This blocklist is missing modern event attributes including onpointerover, onpointerdown, onauxclick, onbeforetoggle, onfocusin, onanimationstart, and ontransitionend. These omitted handlers pass through the sanitizer unfiltered on any HTML tag. The rendered HTML is then assigned directly to mdElement.innerHTML in app/src/config/bazaar.ts without client-side DOMPurify sanitization and without iframe or sandbox isolation. The kernel sends no Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options response headers, allowing inline event handlers to execute when triggered. An authenticated administrator viewing a malicious package README in the marketplace can be exploited when interacting with elements carrying these event handlers.

Business impact

This vulnerability allows unauthorized code execution within an authenticated administrator's SiYuan workspace and can result in complete workspace compromise. An attacker controlling a Bazaar package can exfiltrate sensitive data, modify or delete workspace contents, create new administrative accounts, or establish persistent access. The attack surface includes any administrator who browses the marketplace after giving one-time consent—no explicit package installation is required. For organizations using SiYuan for sensitive documentation, research, or knowledge storage, this represents a critical supply-chain risk vector through the package marketplace.

Affected systems

SiYuan versions prior to 3.7.0 are affected. The vulnerability requires an administrator account and occurs when viewing a package details page in Settings → Marketplace. Open-source deployments, self-hosted instances, and any SiYuan installation with marketplace access are in scope. Users running SiYuan 3.7.0 or later are not affected.

Exploitability

Exploitation requires social engineering or supply-chain trust abuse: a package author (or account takeover of an existing author) publishes or updates a package with a malicious README. When an administrator views that package in the marketplace, the XSS payload fires automatically upon interaction with crafted HTML elements. The CVSS score of 7.1 (HIGH) reflects that user interaction (viewing and interacting with a listing) is required, the attack is network-based, and no special privileges are needed to publish a Bazaar package. The one-time marketplace consent reduces friction but does not add technical complexity. This is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade SiYuan to version 3.7.0 or later. The patch hardens sanitization by expanding the event-handler blocklist to include modern event attributes and likely improves downstream handling of rendered HTML. Organizations unable to upgrade immediately should restrict administrative access to the Bazaar marketplace or block outbound connections to the marketplace service. If marketplace discovery is essential, designate a single low-privilege account for package review and restrict administrative browsing of untrusted packages.

Patch guidance

Download and install SiYuan 3.7.0 or any subsequent stable release from the official SiYuan repository or releases page. Verify the release notes confirm the fix for README rendering security. For self-hosted deployments, stop the SiYuan service, back up the data directory, replace binaries, and restart. For packaged installations (Docker, snap, apt, etc.), follow the distribution's standard upgrade process. Test marketplace functionality post-upgrade to confirm the patch does not break legitimate package discovery or display.

Detection guidance

Monitor SiYuan logs for Bazaar marketplace access by administrative accounts, particularly if marketplace API calls precede unusual workspace modifications or data access. If forensic analysis is needed, inspect the browser console and network logs for inline script execution errors or CSP violations (note: SiYuan does not currently send CSP headers, so this will not block attacks in unpatched versions). Review package README HTML rendered in the DOM for presence of event handler attributes (onpointerover, onpointerdown, etc.) on tags that should not carry them. Check administrative account activity logs for API calls to unauthorized endpoints or privilege-escalation actions correlating with marketplace browsing sessions.

Why prioritize this

This vulnerability merits prompt patching because it enables remote code execution in the administrator's context without requiring package installation, affects the trust model of the marketplace ecosystem, and can lead to full workspace compromise. While the CVSS score is 7.1 (HIGH) rather than CRITICAL, the ease of weaponization through a poisoned package and the high value of SiYuan administrative access (which often guards sensitive personal or organizational knowledge) justify prioritization ahead of many other HIGH-severity issues. Organizations with SiYuan deployments storing confidential information should patch within 1–2 weeks.

Risk score, explained

CVSS 7.1 (HIGH) reflects: (1) HIGH confidentiality and integrity impact (workspace compromise, data exfiltration, modification); (2) LOW availability impact (no denial of service mechanism described); (3) Network attack vector (no authentication required beyond the pre-existing trust of marketplace consent); (4) High attack complexity due to user interaction requirement (administrator must view and interact with a malicious package listing); (5) unprivileged attacker capability (any Bazaar package author, or account takeover). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L accurately captures a remote, high-interaction attack with severe impact on confidentiality and integrity but no cross-scope elevation or sustained DoS.

Frequently asked questions