Critical SiYuan Desktop Flaw Enables RCE

SiYuan desktop versions released prior to v3.7.2 contain a critical reflected cross-site scripting vulnerability within the bazaar plugin readme handler. This flaw, assigned CVE-2026-66395, carries a CVSS score of 9.6 and allows an attacker to execute arbitrary code by crafting a malicious siyuan:// deep link.

Because the vulnerability resides in the application's handling of specific protocol links, an attacker can inject HTML payloads via the plugin name parameter. These payloads are rendered through an insecurely configured Electron renderer, granting the attacker full Node.js access to the underlying system.

What's at Risk

The vulnerability affects all SiYuan desktop users running software versions prior to v3.7.2. Users who interact with untrusted links or plugins are at the highest risk, as the exploit relies on triggering a specially crafted deep link that the application processes.

Any system where this software is installed and configured with default settings remains exposed. Because the application is a desktop tool, the primary risk is to individual workstations and the data stored within the local environment, as the flaw effectively bypasses standard application-level security controls.

How the Flaw Works

Reflected cross-site scripting occurs when an application receives data in an HTTP request or, in this case, a protocol deep link, and includes that data within the immediate response in an unsafe way. When an application fails to properly sanitize input before rendering it, the browser or the application's internal renderer may interpret the input as active content rather than plain text.

In the context of Electron-based applications, this class of vulnerability is particularly dangerous. If the renderer process is configured with excessive permissions, such as enabling Node.js integration, a successful injection can be escalated from simple script execution to full system compromise. Attackers typically use this to execute arbitrary commands, access local files, or move laterally within a system by leveraging the trust the application has with the operating system.

How to Protect Your Systems

• Update your SiYuan desktop installation to v3.7.2 or later immediately to resolve the vulnerability.
• Exercise caution when clicking on unknown or suspicious siyuan:// protocol links, even if they appear to originate from trusted sources.
• Restrict the execution of plugins from unverified or untrusted sources within the application environment.
• Maintain a consistent patch management schedule for all desktop applications to ensure security updates are applied as soon as they are released by vendors.
• Monitor system logs for unusual process activity or unauthorized command execution following the installation of new plugins.

Given the critical severity of this vulnerability and the potential for full Node.js access, prompt action is required. The ability for an attacker to gain remote code execution via a simple link makes this a high-priority risk for all users of the software. Ensuring that the application is updated to the latest version is the only effective way to mitigate this specific RCE vector.