Most recent entries from all

bdu:2026-07547

EUVD-2026-292035

fkie_cve-2026-40922

SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effectively filter srcdoc attributes which contain raw HTML rather than URLs. A malicious bazaar package author can include an iframe with a srcdoc attribute containing embedded scripts in their README. When other users view the package in SiYuan's marketplace UI, the payload executes in the Electron context with full application privileges, enabling arbitrary code execution on the user's machine. This issue has been fixed in version 3.6.4.

GHSA-8q5w-mmxf-48jg — SiYuan has incomplete fix for CVE-2026-33066: XSS

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary

The incomplete fix for SiYuan's bazaar README rendering enables the Lute HTML sanitizer but fails to block `<iframe>` tags, allowing stored XSS via `srcdoc` attributes containing embedded scripts that execute in the Electron context.

### Affected Package

- **Ecosystem:** Go - **Package:** github.com/siyuan-note/siyuan - **Affected versions:** < commit b382f50e1880 - **Patched versions:** >= commit b382f50e1880

### Details

The `renderPackageREADME()` function in `kernel/bazaar/readme.go` renders Markdown README content from bazaar (marketplace) packages into HTML. The original vulnerability allowed stored XSS through unsanitized HTML in READMEs. The fix adds `luteEngine.SetSanitize(true)` to enable Lute's built-in HTML sanitizer.

However, the Lute sanitizer in `lute/render/sanitizer.go` has a critical gap: 1. `<iframe>` is explicitly commented out of `setOfElementsToSkipContent`, so iframe tags pass through. 2. The `srcdoc` attribute is checked against URL-prefix blocklists (`javascript:`, `data:text/html`), but `srcdoc` contains raw HTML content, not a URL. A value like `<img src=x onerror=alert(1)>` does not start with any blocked prefix. 3. The browser renders `srcdoc` HTML in a nested browsing context, executing embedded scripts and event handlers.

The fix correctly blocks direct `<script>` tags, event handler attributes, and `javascript:` protocol links. However:

- `<iframe srcdoc="<script>alert(document.domain)</script>">` passes through because ifra…