## SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

- 種別: advisory
- 重大度: medium
- 関連技術: go, github
- CVE: CVE-2026-62204
- 公開日時: 2026-10-23T18:38:25.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-rpx2-p6hp-x5gj)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-rpx2-p6hp-x5gj

影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808010544-26ccb40d390e → 0.0.0-20260808010544-26ccb40d390e
installBazaarPlugin (and the equivalent endpoints for widgets/icons/templates/themes) accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as packageName while pointing repoURL/ repoHash at different, attacker-influenced cont…