CVE-2026-65606 siyuan-note CVE debrief

Who should care

Defenders and administrators of SiYuan installations should assess exposure and prioritize remediation due to the critical severity of this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the current version, verify exposure, and apply updates or mitigations as necessary.

Why it matters

CVE-2026-65606 is a critical vulnerability in SiYuan before v3.7.2 that allows for cross-site scripting (XSS) and can escalate to arbitrary operating-system command execution. Defenders and administrators of SiYuan installations should assess exposure and prioritize remediation.

• Potential for arbitrary operating-system command execution
• Elevation of privileges through exploitation of vulnerable versions
• Possible disruption of service due to successful attacks
• Need for verification of current version and exposure

Technical summary

The SiYuan application before version 3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it. This allows for injection of an <img onerror=...> element, which can be used to execute arbitrary operating-system commands due to the application's use of nodeIntegration:true in the SiYuan Desktop renderer.

Defensive priority

High

Recommended defensive actions

• Immediately update SiYuan to version 3.7.2 or later
• Restrict access to untrusted sources
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the application's failure to escape the icon parameter in the tab header when handling siyuan://plugins/<name> links. This allows for injection of an <img onerror=...> element, which can be used to execute arbitrary operating-system commands.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.