Live › vulnerability › GHSA-989h-w3q9-3m2f
Go to dashboardSiYuan, a note-taking app, does not check that the package name matches the downloaded plugin content in its bazaar install endpoints. An attacker with same-origin access can overwrite an existing trusted plugin and keep that change across restarts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 3.7.4 | – |
Unknown from the sources.
v3.7.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-rpx2-p6hp-x5gj. This link is maintained to preserve external references.
SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.
This page as .md · .json · in your agent: get_signal("GHSA-989h-w3q9-3m2f")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.