CVE-2026-66395

Name of the Vulnerable Software and Affected Versions SiYuan desktop versions prior to 3.7.2

Description A reflected cross-site scripting issue exists in the bazaar plugin readme handler. An attacker can execute arbitrary code by crafting a malicious siyuan:// deep link. By injecting HTML payloads through the plugin name parameter, the attacker can achieve full Node.js access due to the use of insertAdjacentHTML rendering within an insecurely configured Electron renderer.

Recommendations Update SiYuan desktop to version 3.7.2 or later.