PT-2026-64996 · Siyuan Note · Siyuan

Hypnguyen1209 · CVE-2026-66395 · Published 2026-07-27 · Updated 2026-07-27

Mitre

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-66395

Affected Products

Siyuan

References · 3

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gx2-8gcr-x83f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-66395 · Security Note
• https://vulncheck.com/advisories/siyuan-desktop-before-reflected-xss-to-rce-via-siyuan-protocol · Note