PT-2026-64996 · Siyuan Note · Siyuan

Hypnguyen1209 · CVE-2026-66395 · Publicado 2026-07-27 · Atualizado 2026-07-27

Mitre

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-66395

Produtos afetados

Siyuan

Referências · 3

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gx2-8gcr-x83f · Exploit
• https://vulncheck.com/advisories/siyuan-desktop-before-reflected-xss-to-rce-via-siyuan-protocol · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-66395 · Nota de Segurança