CVE-2026-65606

CriticalCVSS 9.6/10Last modified Sep 17, 2026

Description

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
siyuan-note	siyuan	< 3.7.2

References

Timeline

Published: Jul 23, 2026
Last modified: Sep 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-656076.5SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/se CVE-2026-656088.8Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint CVE-2026-656092.4nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a se CVE-2026-65614.7A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller CVE-2026-656102.4nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execu CVE-2026-656115.1nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted CVE-2026-656125.1nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or in CVE-2026-656134.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting de CVE-2026-656168.8Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.CVE-2026-656178.8A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and CVE-2026-656186.5Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog CVE-2026-65627.3A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Search/index.html. Execu