CVE-2026-62204: Siyuan-Note Siyuan

Medium severity, CVSS 6.6. EPSS: 0.1% chance of exploitation in the next 30 days.

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.

Affected products

• Siyuan-Note Siyuan: before 3.7.4 (fixed in 3.7.4)

Published 2026-08-22. Last modified 2026-08-26.