CVE-2026-62204

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description Insufficient validation occurs in the bazaar install endpoints when verifying if the packageName matches the downloaded package content. Attackers with same-origin access can overwrite trusted plugins by providing mismatched packageName and repoURL parameters, allowing them to maintain persistence across application restarts.

Recommendations Update to version 3.7.4 or later.