## Summary
SiYuan’s Bazaar marketplace contains a stored XSS in package author metadata. In the desktop Electron app, the XSS can escalate to host code execution because nodeIntegration: true and contextIsolation: false are used.
## Technical Details
- Root cause: Bazaar staging preserves raw author values from package metadata and republishes them in stage/*.json.
- Rendering flaw: the author field is inserted into marketplace HTML using innerHTML without escaping.
- Evidence from code paths:
- siyuan-note/bazaar/actions/stage/main.go:869-880 shows sanitization escapes DisplayName and Description, but not Author.
- siyuan-note/bazaar/actions/check/main.go:922-925 only checks author is non-empty; it does not reject HTML.
- siyuan/app/src/config/bazaar.ts injects ${data.author} / ${item.author} directly into HTML via readmeElement.innerHTML = ... and other innerHTML assignments (e.g., marketplace detail panel and card/list rendering).
- siyuan/kernel/bazaar/bazaar.go:48-95 copies online stage metadata to the frontend without equivalent Author escaping.
- Exploitation path (stored XSS):
- Attacker submits a Bazaar package with HTML in plugin.json’s author field.
- Staging republishes the unescaped author into stage/*.json.
- SiYuan renders the author into the marketplace UI, triggering XSS.
- Because Electron windows are configured with nodeIntegration: true and contextIsolation: false, the payload can call Node.js APIs and execute code on the host.
## Affected
- SiYuan desktop app versions: from 2.1.12 to before 3.7.0.
## Impact
- Stored XSS in Bazaar marketplace author metadata.
- Potential host compromise in the desktop app via Node.js API access from the XSS context.
## Mitigation
1. Upgrade SiYuan to 3.7.0 (fix is included in that release).
2. As a defense-in-depth measure, ensure Bazaar author is treated as untrusted and is escaped/rejected during both staging and frontend rendering (the advisory specifically notes Author is not escaped in the current flow).
3. If you maintain a fork or custom marketplace pipeline, add validation to reject HTML in author (the current check only enforces non-empty).
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-79