CVE-2026-33067: 
NixOS vulnerability analysis and mitigation

CVE-2026-33067 is a Stored XSS to Remote Code Execution vulnerability in SiYuan's Bazaar (community marketplace) that allows a malicious package author to inject arbitrary HTML/JavaScript into package metadata fields (displayName, description), which executes automatically when any desktop user browses the marketplace. Discovered and reported by researcher 0xkakash1, it was published on March 17, 2026, and affects SiYuan versions ≤ 3.5.9 across Windows, macOS, and Linux. The patched version is v3.6.1. It carries a CVSS v3.1 base score of 9.0 (Critical) per Feedly intelligence, while the advisory itself cites 9.6 (Critical) (GitHub Advisory, SiYuan Advisory).

The root cause is CWE-79 (Stored XSS): in app/src/config/bazaar.ts (lines 275–277), package metadata fields (preferredName, preferredDesc) are injected directly into HTML template literals without HTML escaping — notably, the title attribute uses escapeAttr() but the rendered text content does not, indicating partial awareness of the risk. The critical escalation factor is SiYuan's Electron configuration in app/electron/main.js (lines 422–426), which sets nodeIntegration: true and contextIsolation: false, granting any JavaScript executing in the renderer process direct access to Node.js APIs such as require('child_process'), require('fs'), and require('os'). An attacker with a low-privilege account (sufficient to submit a package to the Bazaar) can craft a plugin.json manifest with an XSS payload (e.g., <img src=x onerror="require('child_process').exec('calc.exe')">) in the displayName field; the payload fires automatically on page load with no further user interaction required (GitHub Advisory, SiYuan Advisory).

Successful exploitation results in full Remote Code Execution on the victim's operating system with the privileges of the SiYuan application user, affecting all platforms (Windows, macOS, Linux). Attackers can steal API tokens, session cookies, SSH keys, browser credentials, and arbitrary files, and can install persistent backdoors, scheduled tasks, or ransomware. Because the attack vector is the official SiYuan Bazaar marketplace, it constitutes a supply-chain attack capable of targeting the entire SiYuan desktop user community simultaneously — any user who opens the Bazaar tab is compromised without any further interaction (GitHub Advisory, SiYuan Advisory).

A detailed proof-of-concept with step-by-step exploitation instructions and specific JSON payloads is publicly documented in the GitHub Security Advisory, including escalation paths for reverse shell, API token exfiltration, and Windows persistence (SiYuan Advisory). Feedly's exploit analysis confirms the PoC constitutes a real exploit with high confidence. There is no current evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.109% (29th percentile), and the vulnerability is not listed in the CISA KEV catalog as of the time of this report (GitHub Advisory).

1. Create a malicious package repository: Set up a GitHub repository with a valid SiYuan plugin structure. Craft a plugin.json manifest with an XSS payload embedded in the displayName or description field, e.g.:

{
  "name": "helpful-productivity-plugin",
  "displayName": {
    "default": "<img src=x onerror=\"require('child_process').exec('calc.exe')\">"
  },
  "description": { "default": "Boost your productivity" },
  "version": "1.0.0",
  "author": "attacker",
  "url": "https://github.com/attacker/helpful-productivity-plugin",
  "minAppVersion": "2.0.0"
}

2. Submit to the Bazaar: Submit the repository to the SiYuan Bazaar community marketplace via the standard contribution process (pull request to the bazaar index repository). Only low-privilege access (a GitHub account) is required.
3. Wait for victim to browse the marketplace: When any SiYuan desktop user navigates to Settings > Bazaar > Plugins, the package listing renders the malicious displayName without HTML escaping.
4. Zero-click RCE triggers: The <img> tag fails to load, firing the onerror handler. Because Electron is configured with nodeIntegration: true and contextIsolation: false, require('child_process').exec(...) executes directly in the renderer process with OS-level privileges.
5. Escalate as desired: Replace the basic payload with a reverse shell, data exfiltration script (e.g., reading ~/.config/siyuan/ for API tokens), or a persistence mechanism (e.g., Windows scheduled task via schtasks) — all executable without any additional user interaction (SiYuan Advisory).

• Network: Unexpected outbound connections from the SiYuan process to unknown external IPs or attacker-controlled servers (e.g., reverse shell connections on non-standard ports such as 4444); DNS lookups for attacker-controlled domains initiated by the SiYuan Electron process.
• Process: Unusual child processes spawned by the SiYuan Electron renderer (e.g., cmd.exe, powershell.exe, /bin/bash, calc.exe, curl, wget) with SiYuan as the parent process; node.exe or electron.exe spawning shell commands.
• File System: New or modified scheduled tasks (Windows: schtasks /query output; Linux/macOS: new cron entries); unexpected scripts or executables written to user home directories, temp folders, or SiYuan data directories; exfiltration of files such as ~/.ssh/id_rsa, browser credential stores, or SiYuan API token files.
• Logs: SiYuan application logs showing Bazaar page loads followed by unexpected JavaScript errors or Node.js API calls; OS audit logs recording process creation events with SiYuan as the parent and shell interpreters as children.
• Registry (Windows): New Run or RunOnce registry keys created under HKCU\Software\Microsoft\Windows\CurrentVersion\Run by the SiYuan process for persistence (SiYuan Advisory).

Upgrade SiYuan to version v3.6.1 or later, which is the patched release addressing this vulnerability (SiYuan Advisory). As a temporary workaround until patching is possible, restrict or disable access to the Bazaar marketplace tab within SiYuan. The advisory recommends three long-term fixes: (1) HTML-escape all user-controlled metadata fields in bazaar.ts before rendering; (2) implement server-side sanitization in the Bazaar index build pipeline; and (3) harden the Electron configuration by setting nodeIntegration: false, contextIsolation: true, and sandbox: true. After patching, review and revoke any potentially exposed API tokens, SSH keys, or session credentials on affected systems.

The vulnerability was reported by researcher 0xkakash1 and published via GitHub Security Advisories on March 17, 2026 (GitHub Advisory). A technical write-up was published at infinitsec.net covering the stored XSS to RCE chain. The vulnerability was also picked up by openSUSE security announcements and Linux security advisory aggregators, indicating broad community awareness. No major vendor statements beyond the SiYuan project's own advisory have been identified.