Critical severity9.6NVD Advisory· Published Jul 27, 2026· Updated Sep 17, 2026
CVE-2026-66395
CVE-2026-66395
Description
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.7.2
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.