CVE-2026-65606

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2

Description A cross-site scripting issue exists in the siyuan:// protocol handler. When a link using the format siyuan://plugins/<name> references a plugin that is not installed, the application opens a custom tab and inserts the icon parameter into the tab header via innerHTML without proper escaping in the app/src/layout/Tab.ts file. This allows the injection of an <img onerror=...> element. Since the SiYuan Desktop renderer is configured with nodeIntegration:true, the injected JavaScript can access the Node.js require function and execute require('child process').execSync(...), leading to arbitrary operating-system command execution.

Recommendations Update SiYuan to version 3.7.2 or later.