CVE-2026-66395CWE-79cross-site-scripting

CVE-2026-66395

Critical · published July 27, 2026

CVSS v3.1
9.6
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00565 · 46.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-27T20:18Z
References (3)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gx2-8gcr-x83f · [email protected]https://www.vulncheck.com/advisories/siyuan-desktop-before-reflected-xss-to-rce-via-siyuan-protocol · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gx2-8gcr-x83f · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 JUL 15:43Z
    SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol
    cvelistv5