CVE-2026-33067 is a critical stored cross site scripting flaw in SiYuan. Package metadata shown in the Bazaar marketplace is rendered without escaping, so a malicious package can run script just by being listed, and that becomes code execution. Update SiYuan to 3.6.1.
What's affected
The NVD record says SiYuan 3.6.0 and below. The GitHub advisory lists SiYuan up to 3.5.9 and gives v3.6.1 as the patched version. Treat anything below 3.6.1 as affected.
How to check if you're exposed
Open SiYuan's About dialog and read the version. If it is below 3.6.1, you are on an affected build. For a fleet, pull installed versions from your software inventory.
What to do now
- Update SiYuan to 3.6.1 or later on every device.
- Do not open the Bazaar tab on an unpatched install.
- If someone browsed the Bazaar on an old version, review that machine for unexpected processes and changes, and rotate any secrets kept on it.
Why it matters
This is CWE-79, stored cross site scripting. The advisory says the package name and description are placed into the page using template strings without HTML escaping, so markup in those fields is treated as live HTML.
Two things make it worse than a typical XSS. First, the advisory describes it as needing no click beyond opening the marketplace tab. Second, SiYuan's Electron setup enables Node integration without context isolation, so script in the page can run commands on the operating system. A sibling issue in README rendering, CVE-2026-33066, shares the same root pattern. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is this the same bug as CVE-2026-33066?
No. Both are cross site scripting in the Bazaar, but this one is in package metadata and the other is in README rendering. Both are fixed in 3.6.1.
Sources
Last reviewed: 19 October 2026.
