6.6 Medium

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

CVE-2026-62204

Summary installBazaarPlugin (and the equivalent endpoints for widgets/icons/templates/themes) accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as packageName while pointing repoURL/ repoHash at different, attacker-influenced content, silently overwriting the existing plugin's files. Affected code kernel/api/bazaar.go: go util.BindJsonArg("packageName", &packageName, true, true) util.BindJsonArg("repoURL", &repoURL, true, true) util.BindJsonArg("repoHash", &repoHash, true, true) err := model.InstallBazaarPackage("plugins", repoURL, repoHash, packageName, 0) kernel/model/bazaar.go: go func getPackageInstallPath(pkgType, packageName string) (string, string, error) { case "plugins": return filepath.Join(util.DataDir, "plugins", packageName), "plugin.json", nil kernel/bazaar/install.go: go func installPackage(data []byte, installPath string) (err error) { ... if err = filelock.Copy(srcPath, installPath); err !=…

Assessment

CVSS: 6.6 (v3.1)
Severity: Medium
EPSS: 0.00094% chance of exploitation in the next 30 days
Known exploited: Not listed in CISA KEV
Exploit availability: Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
Published: 23 October 2026
Last updated: 23 October 2026
Affected: go · github.com/siyuan-note/siyuan/kernel
Weakness: CWE-345, CWE-668

CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

At the source

GitHub Advisories

References

Community proofs of concept

No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.

Submit a proof of concept

Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.

Title *

Proof of concept *

Write-up (optional)

Affected versions (optional)

Name or handle (optional)

References (optional, one URL per line)

Licence for your contribution *

Private contact (optional, never shown)

Before you submit * This vulnerability is already publicly disclosed (it has a published CVE). This material comes only from testing I was authorised to perform. I have the legal right to publish this content and am not breaching any agreement by doing so. It contains no live credentials, personal data, or anything targeting systems I am not authorised to test. I understand it will be reviewed before it appears publicly and may be rejected. I agree to the submission terms.

What is 9 + 5? *

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2026-62204