THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-62204 (MEDIUM 6.6) — SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persi

[NVD] CVE-2026-62204 (MEDIUM 6.6) — SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persi

mednvdPublished 2026-08-22

CVE-2026-62204 CVSS: 6.6 MEDIUM Published: 2026-08-22T13:16:39.547

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.

Indicators of compromise

CVE-2026-62204cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-62204