CVE-2026-56397: SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

SiYuan’s Bazaar (community marketplace) renders plugin/theme/template metadata and README content without sanitization. A malicious package author can achieve RCE on any user who browses the Bazaar by:

1. Package metadata XSS (zero-click): Package displayName and description fields are injected directly into HTML via template literals without escaping. Just loading the Bazaar page triggers execution.
2. README XSS (one-click): The renderREADME function uses lute.New() without SetSanitize(true), so raw HTML in the README passes through to innerHTML unsanitized.

Both vectors execute in Electron’s renderer with nodeIntegration: true and contextIsolation: false, giving full OS command execution.