CVE-2026-65606
Received Received - Intake

XSS in SiYuan Desktop App via siyuan:// Protocol Handler

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65606
EUVD
EUVD-2026-48242

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65606 is a critical cross-site scripting (XSS) vulnerability in SiYuan Desktop versions before 3.7.2. It allows an attacker to inject malicious JavaScript via a specially crafted siyuan:// protocol link. The injected script can escape the browser sandbox due to nodeIntegration being enabled, leading to arbitrary command execution on the victim's system.

Detection Guidance

Check SiYuan version with 'siyuan --version' or inspect installed plugins via the application's interface. Monitor network traffic for suspicious siyuan:// protocol links or unusual command execution patterns.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary commands on your computer if you open a malicious siyuan:// link. This could lead to data theft, system compromise, or installation of malware. The attack requires user interaction (opening the link) but no special privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules. Organizations using vulnerable SiYuan versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade SiYuan to version 3.7.2 or later immediately. Disable the siyuan:// protocol handler if possible and restrict untrusted link interactions. Review and remove any suspicious plugins or database entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart