SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

Affected: Go: github.com/siyuan-note/siyuan/kernel

# Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

## Summary

SiYuan's Bazaar (community marketplace) renders plugin/theme/template metadata and README content without sanitization. A malicious package author can achieve RCE on any user who browses the Bazaar by:

1. **Package metadata XSS (zero-click):** Package `displayName` and `description` fields are injected directly into HTML via template literals without escaping. Just loading the Bazaar page triggers execution. 2. **README XSS (one-click):** The `renderREADME` function uses `lute.New()` without `SetSanitize(true)`, so raw HTML in the README passes through to `innerHTML` unsanitized.

Both vectors execute in Electron's renderer with `nodeIntegration: true` and `contextIsolation: false`, giving full OS command execution.

## Affected Component

- **Metadata rendering:** `app/src/config/bazaar.ts:275-277` - **README rendering (backend):** `kernel/bazaar/package.go:635-645` (`renderREADME`) - **README rendering (frontend):** `app/src/config/bazaar.ts:607` (`innerHTML`) - **Electron config:** `app/electron/main.js:422-426` (`nodeIntegration: true`) - **Version:** SiYuan <= 3.5.9

## Vulnerable Code

### Vector 1: Package metadata — no HTML escaping (bazaar.ts:275-277)

```typescript // Package name injected directly into HTML template — NO escaping ${item.preferredName}${item.preferredName !== item.name ? ` <span class="ft__on-surface ft__smaller">${item.name}</span>` : ""}

// Package descripti…