https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:18:41.293689+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07547 bdu:2026-07547 2026-10-03T01:18:41.296356+00:00 bdu:2026-07547 https://cve.radiocsirt.org/vuln/euvd-2026-292035 EUVD-2026-292035 2026-10-03T01:18:41.296387+00:00 EUVD-2026-292035 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40922 fkie_cve-2026-40922 2026-10-03T01:18:41.296401+00:00

SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effectively filter srcdoc attributes which contain raw HTML rather than URLs. A malicious bazaar package author can include an iframe with a srcdoc attribute containing embedded scripts in their README. When other users view the package in SiYuan's marketplace UI, the payload executes in the Electron context with full application privileges, enabling arbitrary code execution on the user's machine. This issue has been fixed in version 3.6.4.

 https://cve.radiocsirt.org/vuln/ghsa-8q5w-mmxf-48jg GHSA-8q5w-mmxf-48jg — SiYuan has incomplete fix for CVE-2026-33066: XSS 2026-10-03T01:18:41.296433+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary

The incomplete fix for SiYuan's bazaar README rendering enables the Lute HTML sanitizer but fails to block `<iframe>` tags, allowing stored XSS via `srcdoc` attributes containing embedded scripts that execute in the Electron context.

### Affected Package

- **Ecosystem:** Go - **Package:** github.com/siyuan-note/siyuan - **Affected versions:** < commit b382f50e1880 - **Patched versions:** >= commit b382f50e1880

### Details

The `renderPackageREADME()` function in `kernel/bazaar/readme.go` renders Markdown README content from bazaar (marketplace) packages into HTML. The original vulnerability allowed stored XSS through unsanitized HTML in READMEs. The fix adds `luteEngine.SetSanitize(true)` to enable Lute's built-in HTML sanitizer.

However, the Lute sanitizer in `lute/render/sanitizer.go` has a critical gap: 1. `<iframe>` is explicitly commented out of `setOfElementsToSkipContent`, so iframe tags pass through. 2. The `srcdoc` attribute is checked against URL-prefix blocklists (`javascript:`, `data:text/html`), but `srcdoc` contains raw HTML content, not a URL. A value like `<img src=x onerror=alert(1)>` does not start with any blocked prefix. 3. The browser renders `srcdoc` HTML in a nested browsing context, executing embedded scripts and event handlers.

The fix correctly blocks direct `<script>` tags, event handler attributes, and `javascript:` protocol links. However:

- `<iframe srcdoc="<script>alert(document.domain)</script>">` passes through because ifra…