MEDIUM 6.6 GitHub
CVE-2026-62204
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
## Summary
`installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept
`packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that
they refer to the same package. `packageName` alone determines the install destination;
`repoURL`/`repoHash` alone determine what content gets downloaded and written there. A request
can name an already-installed, already-enabled plugin as `packageName` while pointing `repoURL`/
`repoHash` at diff
Affected Products
- go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808010544-26ccb40d390e
References
- https://github.com/advisories/GHSA-rpx2-p6hp-x5gj
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj
- https://nvd.nist.gov/vuln/detail/CVE-2026-62204
- https://github.com/siyuan-note/siyuan/commit/26ccb40d390eb7d9b04673629a58ab1d69cc7e53
This medium severity vulnerability with a CVSS score of 6.6 was published on 2026-10-23 via GitHub. Affected: go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808010544-26ccb40d390e.
vulnfeed aggregates 17167 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.