Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-66395

SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

CVSS 4.0 9.4 CRITICALCVSS 3.1 9.6 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-66395

Published

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-66395

Published

siyuan

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "siyuan-note",
                    "product": "siyuan",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:golang/github.com/siyuan-note/siyuan",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "3.7.2"
                        },
                        {
                            "version": "3.7.2",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON