CVE-2026-65606

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.

• CWE-79

• https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wp64-x7qh-h728
• https://www.vulncheck.com/advisories/siyuan-before-cross-site-scripting-to-rce
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wp64-x7qh-h728

Published

Jul 23, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65600Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v…5.3
• CVE-2026-65601Traefik versions 3.7.0 through 3.7.6 contain a namespace con…5.3
• CVE-2026-65602Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to…8.8
• CVE-2026-65603The Grav Login plugin (grav-plugin-login) versions <= 3.8.11…8.8
• CVE-2026-65604Skipper contains an incomplete fix for CVE-2026-50197 in whi…8.8
• CVE-2026-65605SiYuan before v3.7.2 contains a stored cross-site scripting …9.6
• CVE-2026-65607SiYuan before v3.7.2 contains a path traversal vulnerability…7.1
• CVE-2026-65608Grav versions >= 1.7.0 and before 2.0.9 contain a remote cod…8.8
• CVE-2026-6561A vulnerability was detected in EyouCMS up to 1.7.1. This is…4.7
• CVE-2026-65616Incorrect authorization validation in refresh token signatur…8.8
• CVE-2026-65617A deserialization weakness in JFrog Artifactory package hand…8.8
• CVE-2026-65618Improper URL validation when handling specific URLs, allows …6.5