CVE-2026-65606
CriticalCVSS 9.6Summary
SiYuan before version v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a non-existent plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping, allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating XSS to arbitrary OS command execution.
Risk Assessment
The risk includes remote code execution on the user's workstation, potentially leading to full system compromise and data theft.
Recommendation
It is recommended to immediately upgrade SiYuan to version v3.7.2 or later.
Original NVD description (English source)
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.