Attack Chain

1. Attacker crafts a malicious siyuan:// deep link, embedding an XSS payload within the plugin name parameter.
2. The crafted deep link is delivered to a victim, typically via social engineering tactics such as email or chat messages.
3. The victim is enticed to click or open the malicious deep link.
4. The operating system's deep link handler invokes the installed SiYuan desktop application to process the siyuan:// URL.
5. The SiYuan application processes the URL, passing the malicious plugin name parameter to the bazaar plugin readme handler.
6. The readme handler renders the crafted HTML payload using insertAdjacentHTML within an insecurely configured Electron renderer process.
7. The embedded JavaScript within the HTML payload executes with full Node.js privileges, allowing the attacker to run arbitrary code on the victim's system.
8. This results in Remote Code Execution (RCE), enabling further compromise such as data exfiltration, installation of malware, or establishing persistence.

Impact

Successful exploitation of CVE-2026-66395 grants an attacker Remote Code Execution (RCE) capabilities on the victim's system. This can lead to severe consequences, including full control over the compromised machine, sensitive data theft, privilege escalation, and deployment of additional malicious payloads like ransomware or backdoors. While specific victim counts or targeted sectors are not detailed in the source, any user of SiYuan desktop applications running a vulnerable version is at risk, across all operating systems where the application is deployed (Windows, Linux, macOS). The high CVSS score of 9.6 reflects the critical nature of this vulnerability.

Recommendation

• Patch CVE-2026-66395 immediately by updating SiYuan desktop to version 3.7.2 or later on all affected Windows, Linux, and macOS systems.
• Deploy the provided Sigma rule "Detect Suspicious Child Process from SiYuan Desktop" to your SIEM and tune for your environment to identify potential RCE attempts originating from the SiYuan application.
• Monitor process creation events for SiYuan.exe (or siyuan on Linux/macOS) spawning unusual child processes such as command shells or scripting interpreters, as outlined in the Sigma rule.
• Educate users about the dangers of opening deep links from untrusted or suspicious sources, especially those that appear to invoke siyuan:// protocol.