SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808010544-26ccb40d390e → 0.0.0-20260808010544-26ccb40d390e

installBazaarPlugin (and the equivalent endpoints for widgets/icons/templates/themes) accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as packageName while pointing repoURL/ repoHash at different, attacker-influenced cont…

Read on GitHub Advisory Database

On 10/24/2026, 03:38 AM, GitHub Advisory Database published "SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin" (type: Advisory). Severity is "Medium" (medium). Related technologies: Go, GitHub. CVE: CVE-2026-62204.