ghsa:GHSA-989H-W3Q9-3M2F: github.com/siyuan-note/siyuan/kernel < 3.7.4

Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin. Affected range: < 3.7.4.

Affected technology

github.com/siyuan-note/siyuan/kernel · < 3.7.4
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · User interaction required

What an attacker can do

Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts. Source advisory’s CVSS 3.1 assessment rates confidentiality and availability impact as low; integrity impact as high.

Published 24-Oct-2026 01:47 UTC

Product: github.com/siyuan-note/siyuan/kernel
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-24 01:45:06.114611+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-989h-w3q9-3m2f.html