Attack Chain

1. An attacker obtains editor permissions within a SiYuan instance or document.
2. The attacker crafts a malicious JavaScript payload containing an onload handler designed to execute arbitrary commands.
3. This payload is injected into the title-img Individual Attribute List value of a Gallery or Kanban cover image within a SiYuan document.
4. The attacker saves the modified document, thereby persisting the malicious payload.
5. A victim user opens the compromised SiYuan document containing the maliciously crafted image.
6. During the rendering of the Gallery or Kanban cover image, the SiYuan application fails to properly escape the injected title-img Individual Attribute List value.
7. The onload handler embedded in the unescaped value executes, triggering the malicious JavaScript within the Electron renderer process.
8. Due to the Electron application's full Node.js access, the malicious JavaScript achieves arbitrary code execution on the victim's system, leading to remote code execution.

Impact

Successful exploitation of CVE-2026-66396 allows an attacker with editor permissions to achieve remote code execution on the system of any user who opens an affected SiYuan document. This can lead to complete compromise of the victim's workstation, including data exfiltration, installation of additional malware, or further lateral movement within an organization's network. While specific victim numbers are not provided, any organization using vulnerable versions of SiYuan where users share or collaborate on documents is at risk.

Recommendation

• Patch CVE-2026-66396 immediately by upgrading SiYuan to version v3.7.2 or later on all affected systems.
• Review access controls within SiYuan instances to ensure only trusted users have editor permissions.