CVE-2026-62204: Insufficient Verification of Data Authenticity in siyuan-note siyuan

CVE-2026-62204 describes an insufficient verification of data authenticity vulnerability in SiYuan note-taking software. Versions prior to 3.7.4 fail to validate that the packageName parameter corresponds to the actual downloaded package content when installing plugins via bazaar endpoints. An attacker who has same-origin access can exploit this by supplying mismatched packageName and repoURL parameters, enabling them to overwrite existing trusted plugins. This can lead to persistence of malicious code across application restarts. The CVSS 4.0 base score is 5.9, indicating a medium severity vulnerability with local attack vector, high attack complexity, partial privileges required, and user interaction needed.

An attacker with same-origin access can overwrite trusted plugins by exploiting the lack of verification between packageName and the downloaded package content. This can allow the attacker to maintain persistence within the application across restarts, potentially leading to unauthorized code execution or manipulation of the application environment.

A fixed version is available: upgrading SiYuan to version 3.7.4 or later resolves this vulnerability. Users should update to this version to ensure proper validation of package authenticity during plugin installation.