CVE-2026-65606 Details
Description
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.
A cross-site scripting vulnerability has been identified in SiYuan Desktop versions prior to 3.7.2. The issue arises in the siyuan:// protocol handler, where links referencing non-installed plugins can inject unescaped icons into the tab header. This injection allows for the execution of JavaScript, which can be exploited to run arbitrary commands on the operating system. The vulnerability exists because the SiYuan Desktop renderer has node integration enabled, allowing access to Node.js functionalities.
Users can update to SiYuan version 3.7.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wp64-x7qh-h728 | CISA-ADP | AdvisoryExploitVendor |
| https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70 | [email protected] | Source CodeVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wp64-x7qh-h728 | [email protected] | AdvisoryExploitVendor |
| https://www.vulncheck.com/advisories/siyuan-before-cross-site-scripting-to-rce | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= 3.7.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | [email protected] |
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |