CVE-2026-66395
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
SiYuan desktop before version 3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler. An attacker can craft a malicious siyuan:// deep link that, when clicked, executes arbitrary JavaScript with full Node.js access via insertAdjacentHTML in an insecurely configured Electron renderer.
Risk Assessment
An attacker can execute arbitrary code in the context of the SiYuan application, potentially leading to data theft, malware installation, or system compromise.
Recommendation
Update SiYuan desktop to version 3.7.2 or later and avoid clicking on suspicious siyuan:// links.
Original NVD description (English source)
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.