A critical cross-site scripting flaw in SiYuan's custom protocol handler escalates to arbitrary OS command execution because the Desktop app runs its renderer with Node integration enabled.
What Is It
CVE-2026-65606 is a cross-site scripting vulnerability (CWE-79) in the siyuan:// protocol handler of the SiYuan note-taking application. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (in app/src/layout/Tab.ts). This allows an attacker to inject an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can reach Node's require and call require('child_process').execSync(...), escalating the XSS into arbitrary operating-system command execution.
Why It Matters
NVD rates this CRITICAL with a CVSS 3.1 base score of 9.6 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H); the secondary CVSS 4.0 score is 9.4. The attack is network-reachable, requires no privileges, and only needs a victim to interact with a malicious link. A successful exploit yields full command execution on the victim's host with high impact to confidentiality, integrity, and availability, and a changed scope; meaning the compromise extends beyond the vulnerable component.
What's Vulnerable
- Product: SiYuan (vendor
siyuan-note), the Desktop application. - Affected versions: All versions before v3.7.2.
- Fixed version: v3.7.2 and later are unaffected.
Patch Status
A fix is available. Upgrading to SiYuan v3.7.2 or later remediates the vulnerability; the fixing commit is 41f2861c87575ff5ac4b50a0520b1a4fe55b4a70. This CVE does not appear in the supplied CISA KEV data, so there is no confirmed active exploitation on record at this time.