CVE-2026-65606: SiYuan before v3.7.2 Cross-Site Scripting to RCE
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('childprocess').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuan Desktopto a version that resolves this vulnerability.Fixed in v3.7.2 - Configuration
Disable Node integration in the renderer so injected JavaScript cannot access Node.js APIs (e.g., require('child_process').execSync) and escalate XSS to OS command execution.
SiYuan Desktop (renderer process) nodeIntegration = false - Compensating control
If siyuan://plugins/<name> links can be reached by untrusted content, block or sanitize those links so plugin names that are not installed cannot trigger rendering/HTML injection via the siyuan:// protocol handler.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65606?
CVE-2026-65606 has a critical severity rating of 9.6.
What type of vulnerability is CVE-2026-65606?
CVE-2026-65606 is a cross-site scripting (XSS) vulnerability that can lead to remote code execution (RCE).
How do I fix CVE-2026-65606?
To fix CVE-2026-65606, upgrade to SiYuan version 3.7.2 or later, where the vulnerability has been patched.
What impact does CVE-2026-65606 have on users?
CVE-2026-65606 can allow attackers to manipulate the application to execute arbitrary code, compromising user data and systems.
Which versions of SiYuan are affected by CVE-2026-65606?
SiYuan versions prior to 3.7.2 are affected by CVE-2026-65606.