CVE-2026-62204: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
installBazaarPlugin (and the equivalent endpoints for widgets/icons/templates/themes) accept
packageName, repoURL, and repoHash as independent request fields with no validation that
they refer to the same package. packageName alone determines the install destination;
repoURL/repoHash alone determine what content gets downloaded and written there. A request
can name an already-installed, already-enabled plugin as packageName while pointing repoURL/
repoHash at different, attacker-influenced content, silently overwriting the existing plugin’s
files.
References
- github.com/advisories/GHSA-rpx2-p6hp-x5gj
- github.com/siyuan-note/siyuan/commit/26ccb40d390eb7d9b04673629a58ab1d69cc7e53
- github.com/siyuan-note/siyuan/releases/tag/v3.8.0
- github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj
- nvd.nist.gov/vuln/detail/CVE-2026-62204
- www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install
Code Behaviors & Features
Detect and mitigate CVE-2026-62204 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →