CyberRota Analysis
AI-GeneratedThe SiYuan desktop application prior to version 3.7.2 is vulnerable to a reflected cross-site scripting flaw in the bazaar plugin's readme handler, enabling attackers to execute arbitrary code via malicious siyuan:// deep links. This vulnerability allows for the injection of HTML payloads that run with full Node.js access, posing a significant security risk. Organizations using this application should prioritize patching to mitigate the potential for exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.