Executive brief
SiYuan, a personal knowledge management and note-taking application, is vulnerable to a critical security flaw in how it handles custom links. An attacker can craft a malicious link that, when clicked by a user, executes unauthorized commands on the user's computer. This could allow a remote attacker to steal sensitive data, install malware, or take full control of the affected system.
Technical details
A cross-site scripting (XSS) vulnerability exists in the SiYuan Desktop application's handling of the 'siyuan://' protocol. When the application processes a 'siyuan://plugins/<name>' link where the plugin name does not exist, it opens a custom tab and inserts the 'icon' URL parameter directly into the tab header's innerHTML without proper escaping in 'app/src/layout/Tab.ts'. Because the Electron-based desktop renderer is configured with 'nodeIntegration: true', an attacker can use this XSS to access Node.js primitives. Specifically, an attacker can inject an 'img' tag with an 'onerror' attribute to call 'require(child_process).execSync()', leading to arbitrary command execution. The vulnerability is patched in version 3.7.2.
Affected products
- siyuan-note SiYuan < 3.7.2
Timeline
- 2026-07-10: advisory: GitHub Security Advisory GHSA-wp64-x7qh-h728 published
- 2026-07-23: disclosed: CVE-2026-65606 published to NVD
- 2026-07-23: patched: Fix confirmed in version 3.7.2