CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-66395 — SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerabi...

·Source: NIST NVD

Updated:

Executive Summary

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

Analysis

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer. CVSS Score: 9.6. Published: 2026-07-27T16:18:12.083.

Indicators of Compromise (1)

CVE (1)
CVE-2026-66395
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 27, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Circle buys IBM's blockchain patent portfolio

Stablecoin issuer Circle Internet Finance has acquired nearly 1000 blockchain-related patents from IBM.

Finextra
MEDIUMVulnerabilityNEW

Wyden Calls for Edge Device Annihilation in US Government

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/wyden-calls-for-edge-device-annihilation-in-us-government-image_small-6-a-32344.jpg" align=right hspace=4><b>US Senator Says Zero Trust Must Replace Legacy Edge Devices in 2028</b><br>Network devices conversion into nation-state hackers' favorite initial access vector has a U.S. senator urging the federal government to phase out l

Bank Info Security
CRITICALVulnerability

US Space Cybersecurity: 'No One Is in Charge'

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/us-space-cybersecurity-no-one-in-charge-image_small-6-a-32342.jpg" align=right hspace=4><b>Cyber Defense Falters Without Cabinet Agency or White House Champion for Security</b><br>No single senior official is in charge of U.S. efforts to help secure commercial satellites and their land-based infrastructure. That leadership void ha

Bank Info Security