CVE-2026-62204
Received Received - Intake

SiYuan Plugin Spoofing via Bazaar Install Endpoint

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-62204
EUVD
EUVD-2026-64270

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions before v3.7.4 have a flaw in their Bazaar install endpoints where the packageName parameter is not validated against the downloaded package content. Attackers with same-origin access can exploit this by providing mismatched packageName and repoURL parameters to overwrite trusted plugins. This allows malicious code to persist across application restarts.

Detection Guidance

Detecting this vulnerability requires checking SiYuan versions before v3.7.4 and inspecting plugin installation logs for mismatched packageName and repoURL parameters. Review bazaar install endpoints for unauthorized plugin overwrites or unexpected file modifications in plugin directories.

Impact Analysis

This vulnerability enables attackers to replace trusted plugins with malicious ones. If an attacker gains same-origin script execution (e.g., via XSS), they can overwrite existing plugins, causing the malicious code to execute every time the application starts. This leads to persistent compromise of the application's integrity.

Compliance Impact

This vulnerability could violate compliance requirements that mandate data integrity and secure software updates, such as GDPR's integrity principle or HIPAA's security rule for protecting electronic protected health information. Unauthorized plugin overwrites may lead to unauthorized code execution, compromising confidentiality and integrity of user data.

Mitigation Strategies

Upgrade SiYuan to v3.7.4 or later. Disable bazaar install endpoints if not needed. Implement strict validation to ensure packageName matches downloaded package metadata before installation. Monitor plugin directories for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart