Threats tagged 'ghsa-rv6c-xvcj-4qwg'

SiYuan note-taking software versions prior to 3.8.2 contain a stored cross-site scripting (XSS) vulnerability. This flaw occurs because the iconURL metadata in Bazaar package cards is inserted directly into HTML img src attributes without proper escaping. An attacker can exploit this by injecting malicious URLs with event handlers that execute JavaScript when authenticated users view Bazaar listings. This enables unauthorized API requests and manipulation of application state within the authenticated session.