{"id":"ghsa-ghsa-rpx2-p6hp-x5gj","seq":544314,"kind":"advisory","title":"SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin","url":"https://github.com/advisories/GHSA-rpx2-p6hp-x5gj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rpx2-p6hp-x5gj","summary":"影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808010544-26ccb40d390e → 0.0.0-20260808010544-26ccb40d390e\ninstallBazaarPlugin (and the equivalent endpoints for widgets/icons/templates/themes) accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as packageName while pointing repoURL/ repoHash at different, attacker-influenced cont…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-62204"],"tags":["GHSA-rpx2-p6hp-x5gj","github.com/siyuan-note/siyuan/kernel"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T18:38:25.000Z","fetched_at":"2026-10-23T18:42:53.259Z"}