SiYuan versions prior to 3.7.0 have an XSS vulnerability in the Bazaar (community marketplace) UI. The kernel-side helper function only escapes certain fields (Author, DisplayName, Description) but leaves Name and Version unescaped. These unescaped fields are inserted directly into HTML template strings and assigned to innerHTML in the frontend, enabling execution of malicious HTML or scripts embedded in these fields. This vulnerability is addressed in SiYuan 3.7.0.

Successful exploitation allows an attacker to execute arbitrary HTML or JavaScript code in the context of the user's browser when they open the marketplace tab. This can lead to full compromise of confidentiality, integrity, and availability of the affected user's session and data within the application. The CVSS score of 9 indicates critical severity with network attack vector, low attack complexity, requiring user interaction, and resulting in high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in SiYuan version 3.7.0. Users should upgrade to version 3.7.0 or later to remediate this issue. There is no vendor advisory explicitly provided here, but the description confirms the fix in 3.7.0. Until upgrading, users should avoid opening the marketplace tab with untrusted plugins or themes. Patch status is confirmed by the version fix information.