Vulnerability Description
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gx2-8gcr-x83f
- https://www.vulncheck.com/advisories/siyuan-desktop-before-reflected-xss-to-rce-
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gx2-8gcr-x83f
FAQ
What is CVE-2026-66395?
CVE-2026-66395 is a vulnerability with a CVSS score of 9.6 (CRITICAL). SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:...
How severe is CVE-2026-66395?
CVE-2026-66395 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-66395?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.