SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808010544-26ccb40d390e → 0.0.0-20260808010544-26ccb40d390e

installBazaarPlugin (and the equivalent endpoints for widgets/icons/templates/themes) accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as packageName while pointing repoURL/ repoHash at different, attacker-influenced cont…

在 GitHub Advisory Database 阅读

2026/10/24 03:38，GitHub Advisory Database 发布了“SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Go、GitHub。CVE：CVE-2026-62204。