Cross-Site Scripting Vulnerability in SiYuan by SiYuan
CVE-2026-65606

9.4CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
23 July 2026

What is CVE-2026-65606?

SiYuan versions prior to v3.7.2 are susceptible to a cross-site scripting exploit via the siyuan:// protocol handler when referencing non-installed plugins. This vulnerability allows an attacker to inject malicious JavaScript into the tab header through the icon parameter, which is not properly sanitized. Since SiYuan Desktop operates with Node integration enabled, the malicious script can exploit this feature to execute arbitrary commands on the host operating system, significantly increasing the risk of compromise.

Affected Version(s)

siyuan 0 < 3.7.2

siyuan 3.7.2

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://github.com/siyuan-note/siyuan/commit/41f2861c8757...
patch
https://www.vulncheck.com/advisories/siyuan-before-cross-...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hyuunnn
.