CVE-2026-66395
SiYuan desktop versions prior to 3.7.2 contain a reflected cross‑site scripting flaw in the bazaar plugin’s readme handler. By sending a specially crafted siyuan:// deep link, an attacker can inject HTML that runs with full Node.js privileges. This allows the attacker to execute arbitrary code on the victim’s machine.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of SiYuan desktop before version 3.7.2 who have the bazaar plugin enabled.
Real-world impact
An attacker can run any code on the victim’s computer, potentially stealing data, installing malware, or taking full control of the system.
Why this severity
The CVSS score of 9.4 reflects the vulnerability’s high impact: it grants attackers full Node.js access (confidentiality, integrity, and availability are all compromised) and requires only a crafted link, making exploitation trivial for a motivated attacker.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources