CVE-2026-65606 - SiYuan XSS to RCE Vulnerability

CVE-2026-65606 describes a critical cross-site scripting (XSS) vulnerability found in the SiYuan desktop application, affecting all versions prior to 3.7.2. The flaw resides within the siyuan:// protocol handler, specifically when processing links for non-existent plugins (e.g., siyuan://plugins/<name>). If such a link includes an icon parameter containing an unescaped XSS payload, like an <img onerror=...> element, the application inserts this content directly into the tab header via innerHTML (as observed in app/src/layout/Tab.ts). This allows arbitrary JavaScript execution within the application's context. Critically, because the SiYuan Desktop renderer operates with nodeIntegration:true, the injected JavaScript can access Node.js's require function, enabling a direct escalation to arbitrary operating system command execution through calls like require('child_process').execSync(...). This vulnerability allows for full system compromise on affected user machines.

Attack Chain

1. Attacker crafts a malicious siyuan://plugins/<name>?icon=<img onerror='javascript_payload'> link, where <name> is a reference to a non-installed plugin and javascript_payload contains the XSS code.
2. The javascript_payload is specifically designed to leverage Node.js functionality, such as require('child_process').execSync(), to execute system commands.
3. The attacker delivers this malicious link to a victim, often through social engineering, messaging platforms, or by embedding it on a controlled web page.
4. The victim is enticed to click or open the malicious siyuan:// link, which is handled by the SiYuan desktop application.
5. SiYuan processes the link, attempts to open a custom tab for the specified non-existent plugin, and insecurely inserts the attacker-controlled icon parameter's content into the tab header via innerHTML.
6. The injected <img> element triggers its onerror JavaScript payload due to the application's failure to properly escape the input, executing the attacker's code within the application's context.
7. Operating within an environment where nodeIntegration:true is enabled, the executed JavaScript code successfully invokes require('child_process').execSync() to execute arbitrary commands on the host operating system.
8. This results in arbitrary code execution, granting the attacker full control over the victim's Windows, Linux, or macOS system.

Impact

Successful exploitation of CVE-2026-65606 leads to arbitrary operating system command execution on the victim's machine. This grants the attacker full control over the compromised system, potentially allowing for data theft, installation of additional malware (such as ransomware or cryptominers), persistence mechanisms, and lateral movement within a network. The CVSS v3.1 base score of 9.6 indicates a critical severity, signifying a high likelihood of complete confidentiality, integrity, and availability compromise on affected desktop systems. While no specific victim counts or targeted sectors are publicly disclosed, any user running an unpatched SiYuan Desktop application is at risk.

Recommendation

• Patch CVE-2026-65606 by updating SiYuan Desktop to version 3.7.2 or later immediately.
• Implement endpoint detection and response (EDR) rules to monitor for suspicious process creation originating from the SiYuan application, especially for child processes like cmd.exe, powershell.exe, bash, or other shell interpreters that deviate from normal application behavior.