CVE-2026-66395: SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler…
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.
- Published by source
- 2026-07-27
- First seen by Reality Radar
- 2026-10-24
- Last verified
- 2026-10-24
What the official notice says
Risk: critical severity (CVSS 9.6)
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-07-27
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1590 | new | 2026-10-24 | 8b782fba0d58…93c68a | 158ddb2c4f85…9d4474 |
Chain head: #1609 a9149670ca39…bb921c