SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-66395

CRITICAL · CVSS 9.6 EPSS 0.33% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-27 · Last synced 2026-08-26

CyberRota Analysis

AI-Generated

The SiYuan desktop application prior to version 3.7.2 is vulnerable to a reflected cross-site scripting flaw in the bazaar plugin's readme handler, enabling attackers to execute arbitrary code via malicious siyuan:// deep links. This vulnerability allows for the injection of HTML payloads that run with full Node.js access, posing a significant security risk. Organizations using this application should prioritize patching to mitigate the potential for exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-66395
Severity
CRITICAL
CVSS
9.6
EPSS
0.33%

Original NVD Description

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.