CVE-2026-66395
Received Received - Intake

Reflected XSS in SiYuan Desktop via Bazaar Plugin

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66395
EUVD
EUVD-2026-49328

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan desktop to 3.7.2 (exc)
siyuan siyuan to 3.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66395 is a critical reflected cross-site scripting (XSS) vulnerability in SiYuan desktop versions before 3.7.2. It allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. The flaw exists in the bazaar plugin readme handler where user-controlled input is reflected without proper sanitization. The Electron renderer's insecure configuration (nodeIntegration: true, contextIsolation: false) enables the injected HTML to run with full Node.js privileges, leading to remote code execution (RCE).

Detection Guidance

To detect this vulnerability, monitor for unusual siyuan:// deep link activity in network logs or browser history. Check SiYuan application logs for suspicious plugin readme handler requests. Inspect Electron renderer processes for insecure configurations like nodeIntegration: true or contextIsolation: false.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system with the same privileges as the SiYuan application. A single click on a malicious siyuan:// deep link can compromise your operating system, steal data, install malware, or take control of your device. It affects all open SiYuan workspace windows simultaneously.

Compliance Impact

This vulnerability can lead to severe data breaches, unauthorized access, and loss of sensitive information, which directly violates compliance requirements under GDPR (data protection), HIPAA (health information security), and other regulations. Organizations using vulnerable SiYuan versions may face legal penalties, reputational damage, and mandatory breach notifications.

Mitigation Strategies

Immediately update SiYuan to version 3.7.2 or later. Disable siyuan:// protocol handling in your OS if possible. Configure your browser to block siyuan:// links. Review Electron security settings to ensure contextIsolation, sandbox, and webSecurity are enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66395. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart