{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/siyuan-before-v3.7.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-65606"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SiYuan (before v3.7.2)"],"_cs_severities":["critical"],"_cs_tags":["xss","rce","desktop-application","vulnerability","cve"],"_cs_type":"advisory","_cs_vendors":["SiYuan"],"content_html":"\u003cp\u003eCVE-2026-65606 describes a critical cross-site scripting (XSS) vulnerability found in the SiYuan desktop application, affecting all versions prior to 3.7.2. The flaw resides within the \u003ccode\u003esiyuan://\u003c/code\u003e protocol handler, specifically when processing links for non-existent plugins (e.g., \u003ccode\u003esiyuan://plugins/\u0026lt;name\u0026gt;\u003c/code\u003e). If such a link includes an \u003ccode\u003eicon\u003c/code\u003e parameter containing an unescaped XSS payload, like an \u003ccode\u003e\u0026lt;img onerror=...\u0026gt;\u003c/code\u003e element, the application inserts this content directly into the tab header via \u003ccode\u003einnerHTML\u003c/code\u003e (as observed in \u003ccode\u003eapp/src/layout/Tab.ts\u003c/code\u003e). This allows arbitrary JavaScript execution within the application's context. Critically, because the SiYuan Desktop renderer operates with \u003ccode\u003enodeIntegration:true\u003c/code\u003e, the injected JavaScript can access Node.js's \u003ccode\u003erequire\u003c/code\u003e function, enabling a direct escalation to arbitrary operating system command execution through calls like \u003ccode\u003erequire('child_process').execSync(...)\u003c/code\u003e. This vulnerability allows for full system compromise on affected user machines.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious \u003ccode\u003esiyuan://plugins/\u0026lt;name\u0026gt;?icon=\u0026lt;img onerror='javascript_payload'\u0026gt;\u003c/code\u003e link, where \u003ccode\u003e\u0026lt;name\u0026gt;\u003c/code\u003e is a reference to a non-installed plugin and \u003ccode\u003ejavascript_payload\u003c/code\u003e contains the XSS code.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ejavascript_payload\u003c/code\u003e is specifically designed to leverage Node.js functionality, such as \u003ccode\u003erequire('child_process').execSync()\u003c/code\u003e, to execute system commands.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers this malicious link to a victim, often through social engineering, messaging platforms, or by embedding it on a controlled web page.\u003c/li\u003e\n\u003cli\u003eThe victim is enticed to click or open the malicious \u003ccode\u003esiyuan://\u003c/code\u003e link, which is handled by the SiYuan desktop application.\u003c/li\u003e\n\u003cli\u003eSiYuan processes the link, attempts to open a custom tab for the specified non-existent plugin, and insecurely inserts the attacker-controlled \u003ccode\u003eicon\u003c/code\u003e parameter's content into the tab header via \u003ccode\u003einnerHTML\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe injected \u003ccode\u003e\u0026lt;img\u0026gt;\u003c/code\u003e element triggers its \u003ccode\u003eonerror\u003c/code\u003e JavaScript payload due to the application's failure to properly escape the input, executing the attacker's code within the application's context.\u003c/li\u003e\n\u003cli\u003eOperating within an environment where \u003ccode\u003enodeIntegration:true\u003c/code\u003e is enabled, the executed JavaScript code successfully invokes \u003ccode\u003erequire('child_process').execSync()\u003c/code\u003e to execute arbitrary commands on the host operating system.\u003c/li\u003e\n\u003cli\u003eThis results in arbitrary code execution, granting the attacker full control over the victim's Windows, Linux, or macOS system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65606 leads to arbitrary operating system command execution on the victim's machine. This grants the attacker full control over the compromised system, potentially allowing for data theft, installation of additional malware (such as ransomware or cryptominers), persistence mechanisms, and lateral movement within a network. The CVSS v3.1 base score of 9.6 indicates a critical severity, signifying a high likelihood of complete confidentiality, integrity, and availability compromise on affected desktop systems. While no specific victim counts or targeted sectors are publicly disclosed, any user running an unpatched SiYuan Desktop application is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65606 by updating SiYuan Desktop to version 3.7.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement endpoint detection and response (EDR) rules to monitor for suspicious process creation originating from the SiYuan application, especially for child processes like \u003ccode\u003ecmd.exe\u003c/code\u003e, \u003ccode\u003epowershell.exe\u003c/code\u003e, \u003ccode\u003ebash\u003c/code\u003e, or other shell interpreters that deviate from normal application behavior.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T12:20:44Z","date_published":"2026-07-23T12:20:44Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-65606-siyuan-xss-rce/","summary":"A critical cross-site scripting (XSS) vulnerability, CVE-2026-65606, exists in SiYuan desktop application versions prior to 3.7.2's `siyuan://` protocol handler, allowing an attacker to inject an unescaped `\u003cimg\u003e` element into the tab header, leading to arbitrary JavaScript execution and ultimately operating system command execution due to `nodeIntegration:true`.","title":"CVE-2026-65606 - SiYuan XSS to RCE Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-65606-siyuan-xss-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - SiYuan (Before V3.7.2)","version":"https://jsonfeed.org/version/1.1"}