GHSA-8q5w-mmxf-48jg

### Summary The incomplete fix for SiYuan's bazaar README rendering enables the Lute HTML sanitizer but fails to block `<iframe>` tags, allowing stored XSS via `srcdoc` attributes containing embedded scripts that execute in the Electron context. ### Affected Package - **Ecosystem:** Go - **Package:** github.com/siyuan-note/siyuan - **Affected versions:** < commit b382f50e1880 - **Patched versions:** >= commit b382f50e1880 ### Details The `renderPackageREADME()` function in `kernel/bazaar/readme.go` renders Markdown README content from bazaar (marketplace) packages into HTML. The original vulnerability allowed stored XSS through unsanitized HTML in READMEs. The fix adds `luteEngine.SetSanitize(true)` to enable Lute's built-in HTML sanitizer. However, the Lute sanitizer in `lute/render/sanitizer.go` has a critical gap: 1. `<iframe>` is explicitly commented out of `setOfElementsToSkipContent`, so iframe tags pass through. 2. The `srcdoc` attribute is checked against URL-prefix blocklists (`javascript:`, `data:text/html`), but `srcdoc` contains raw HTML content, not a URL. A value like `<img src=x onerror=alert(1)>` does not start with any blocked prefix. 3. The browser renders `srcdoc` HTML in a nested browsing context, executing embedded scripts and event handlers. The fix correctly blocks direct `<script>` tags, event handler attributes, and `javascript:` protocol links. However: - `<iframe srcdoc="<script>alert(document.domain)</script>">` passes through because iframe is not blocked and the srcdoc value is raw HTML (not a URL scheme). - `<iframe srcdoc="<img src=x onerror=alert(document.cookie)>">` also passes because the event handler is inside the srcdoc string value, not a top-level tag attribute. ### PoC ```python """ CVE-2026-33066 - Incomplete Sanitization in SiYuan Bazaar README Rendering Component: kernel/bazaar/readme.go :: renderPackageREADME() Patch: https://github.com/siyuan-note/siyuan/commit/b382f50e1880ed996364509de5a10a72d7409428 """ imp