SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808010544-26ccb40d390e → 0.0.0-20260808010544-26ccb40d390e

installBazaarPlugin (and the equivalent endpoints for widgets/icons/templates/themes) accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as packageName while pointing repoURL/ repoHash at different, attacker-influenced cont…

GitHub Advisory Databaseで読む

2026/10/24 03:38、GitHub Advisory Databaseが「SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Go、GitHub。CVE: CVE-2026-62204。