Attack Chain

1. An attacker crafts a malicious payload containing JavaScript, such as <img src=x onerror='require("child_process").exec("calc.exe")'>.
2. The attacker inserts this payload into a "Template" column value within the "Attribute View" of a SiYuan database entry.
3. The SiYuan application stores this malicious payload unescaped because its HasUnclosedHtmlTag check skips balanced self-closing tags, circumventing proper HTML escaping.
4. A legitimate user accesses or views the database entry containing the maliciously crafted input within the SiYuan application.
5. The SiYuan desktop renderer processes and renders the database cell content, inserting the stored malicious HTML payload directly into the page's Document Object Model (DOM) via innerHTML.
6. The embedded JavaScript code (e.g., within the onerror attribute of the <img> tag) executes within the context of the SiYuan application.
7. Due to nodeIntegration being enabled in the desktop renderer, the executed JavaScript gains access to Node.js APIs, including the require function.
8. The script leverages require to load Node.js modules (e.g., child_process) and execute arbitrary commands on the victim's underlying operating system, achieving remote code execution.

Impact

Successful exploitation of CVE-2026-65605 results in arbitrary code execution on the victim's operating system with the privileges of the SiYuan desktop application. This can lead to complete compromise of the affected system, including data theft, installation of additional malware, or further network lateral movement. The vulnerability's CVSS v3.1 Base Score is 9.6, indicating critical severity. All users running SiYuan desktop applications prior to version v3.7.2 are at risk.

Recommendation

• Patch CVE-2026-65605 by updating all SiYuan installations to version v3.7.2 or later immediately.
• Implement strong egress filtering to prevent unauthorized outbound connections initiated by potentially compromised applications.