CVE-2026-54070

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0

Description The renderPackageREADME function in kernel/bazaar/readme.go renders Bazaar package READMEs from Markdown to HTML using the lute engine. The sanitizer uses a blocklist that omits modern event handlers, allowing attributes such as onpointerover, onpointerdown, onauxclick, onbeforetoggle, onfocusin, onanimationstart, and ontransitionend to pass through verbatim. The frontend then assigns this HTML to mdElement.innerHTML in app/src/config/bazaar.ts without client-side DOMPurify, inserting it into the main document without a sandbox or iframe. Because the kernel does not send Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options headers, an attacker can execute JavaScript in the Administrator's authenticated origin when the Administrator views a package in the Marketplace settings, potentially gaining full control of the workspace.

Recommendations Update to version 3.7.0.