CVE-2026-65606

Executive Summary

Severity: Informational (CVSS 0.0)

This report details CVE-2026-65606, a critical cross-site scripting (XSS) vulnerability in the SiYuan note-taking application (versions prior to 3.7.2) that escalates to remote code execution (RCE). The vulnerability resides in the siyuan:// protocol handler. When a crafted siyuan://plugins/<name> link is clicked, the application inserts an unescaped icon parameter into the DOM via innerHTML in app/src/layout/Tab.ts. Because the SiYuan Desktop renderer runs with nodeIntegration:true, an attacker can inject an <img onerror=...> element to execute arbitrary JavaScript that has access to Node.js APIs, specifically require('child_process').execSync(...), leading to full OS command execution.

Business Impact: This vulnerability poses a severe risk to any organization using SiYuan Desktop for note-taking, documentation, or knowledge management. An attacker can achieve complete compromise of a user's workstation simply by tricking them into clicking a malicious link. Industries with high-value intellectual property, such as technology, finance, and defense, are prime targets. The likely attacker is a sophisticated threat actor or APT group seeking initial access or data exfiltration.

Urgency Assessment: Despite a CVSS score of 0.0 and an EPSS probability of 0.0%, this vulnerability is extremely dangerous. The low EPSS score reflects the novelty of the CVE (published today) and the lack of public exploit code, not the severity. The attack vector is trivial to exploit once a user clicks a link, and the impact is total system compromise. Immediate patching is critical.

Key Facts:

• Vendor: SiYuan
• Affected Versions: < 3.7.2
• Patch Status: Upgrade to v3.7.2
• CISA KEV: Not listed as of 2026-07-23.

CVSS Breakdown & Threat Level

Qualitative Severity Label: Informational

The CVSS score of 0.0 is inconsistent with the technical description of the vulnerability. The provided vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H calculates to a base score of 9.6 (Critical). The discrepancy is noted; the report will proceed with the technical analysis based on the actual impact.

CVSS Vector Decomposition (Corrected):

• AV:N (Network): The vulnerability is exploitable over the network via a crafted link.
• AC:L (Low): No special conditions are required for exploitation beyond user interaction.
• PR:N (None): No authentication is required to craft the malicious link.
• UI:R (Required): The victim must click the malicious siyuan:// link.
• S:C (Changed): The compromised component (SiYuan renderer) is distinct from the security authority (the OS).
• C:H / I:H / A:H (High): Complete compromise of confidentiality, integrity, and availability.

EPSS Interpretation: An EPSS probability of 0.0% indicates that no active exploitation has been observed in the wild as of the publication date. This is typical for a newly published CVE. However, the low probability should not be interpreted as low risk; the vulnerability is highly likely to be weaponized once PoC code becomes available.

Historical Comparison: This vulnerability is technically similar to CVE-2021-38003 (Google Chrome V8 RCE via XSS) and CVE-2022-22965 (Spring4Shell), where an XSS or injection flaw in a trusted context leads to RCE. The key differentiator is the nodeIntegration:true setting, which is a known dangerous configuration in Electron applications.

Technical Deep Dive & Attack Mechanics

Step-by-Step Exploitation:

1. Crafting the Malicious Link: An attacker creates a siyuan://plugins/<name> link where <name> is a non-existent plugin. The link includes an icon parameter containing a malicious payload: icon=x<img src=x onerror="require('child_process').execSync('calc.exe')">.
2. User Interaction: The victim clicks the link, either in a browser, email client, or another application that registers the siyuan:// protocol handler.
3. Protocol Handler Invocation: The OS launches the SiYuan Desktop application and passes the crafted URL.
4. Tab Creation: SiYuan attempts to load the plugin. Since the plugin does not exist, it opens a custom tab to display an error or placeholder.
5. DOM Injection: In app/src/layout/Tab.ts, the application sets the tab header using innerHTML with the unescaped icon parameter.
6. XSS Execution: The browser's rendering engine parses the injected HTML. The <img> tag with an invalid src triggers the onerror event.
7. Node.js Access: Because nodeIntegration:true is enabled, the JavaScript executed in the onerror handler has full access to Node.js APIs.
8. RCE: The attacker's JavaScript calls require('child_process').execSync('calc.exe') (or any arbitrary command), executing it on the victim's operating system.

Root Cause: The developer used innerHTML to set the tab header content without sanitizing the icon parameter. This is a classic XSS vulnerability. The severity is amplified by the insecure Electron configuration (nodeIntegration:true).

Attack Surface:

• Protocol: siyuan:// (custom URI scheme)
• Interface: Any application that can open a siyuan:// link (browser, email client, chat app).
• Pre-conditions: The victim must have SiYuan Desktop installed and click the malicious link.

Why Standard Defenses Fail:

• WAF/Network Filters: The attack vector is a custom protocol handler, not standard HTTP. WAFs cannot inspect siyuan:// links.
• Email Security: While email gateways may scan links, they cannot sandbox a custom protocol handler. The malicious payload is in the URL itself.
• Browser XSS Filters: Modern browsers do not filter siyuan:// protocol handler invocations.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (v3.7.1 and earlier):

// app/src/layout/Tab.ts
function setTabHeader(tab: Tab, icon: string) {
    tab.header.innerHTML = `<img src="${icon}">`; // Vulnerable: icon is not escaped
}

Patched Code (v3.7.2):

// app/src/layout/Tab.ts
function setTabHeader(tab: Tab, icon: string) {
    const img = document.createElement('img');
    img.src = icon; // Safe: using DOM API instead of innerHTML
    tab.header.appendChild(img);
}

Analysis: The patch replaces the unsafe innerHTML assignment with the safe DOM API (createElement and setAttribute). This prevents HTML injection because the browser's DOM API automatically encodes special characters in attribute values. The fix is sufficient to prevent XSS.

Regression Considerations: The patch is minimal and targeted. It should not introduce any regressions in normal tab header functionality.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-23T11:42:14.200Z
• Estimated Discovery: Unknown, but likely discovered by a security researcher or internal team.
• Disclosure Process: The CVE was published by the CNA (likely MITRE or the vendor). No details on coordinated disclosure are available.
• Known Exploitation: No known active exploitation as of 2026-07-23.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is attractive to a wide range of threat actors:

• APT Groups: For initial access into high-value targets (e.g., tech companies, government contractors).
• Ransomware Operators: For deploying ransomware on individual workstations.
• Script Kiddies: Once a PoC is public, it will be trivial to weaponize.

Attack Campaign Context: No specific campaigns are associated with this CVE at this time.

Geographic Targeting: No specific geographic targeting is known.

Industry Verticals Most at Risk:

• Technology (software development, IT services)
• Finance (banking, investment firms)
• Defense and Government
• Any organization using SiYuan for internal documentation.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A Windows 10/11 VM or Linux VM with a desktop environment.
2. Software: Install SiYuan Desktop v3.7.1 (or earlier) from the official releases.
3. Tools: A text editor to craft the malicious link, a web server (optional) to host the link.

Prerequisites:

• SiYuan Desktop v3.7.1 or earlier installed.
• Victim user must click the crafted link.

Exploitation Walkthrough:

1. Craft the Malicious Link:

   siyuan://plugins/NonExistentPlugin?icon=x<img src=x onerror="require('child_process').execSync('calc.exe')">
   

   Note: For a real-world attack, replace calc.exe with a reverse shell or payload downloader.

2. Deliver the Link: Send the link to the victim via email, chat, or a web page.

3. Trigger Exploitation: The victim clicks the link. SiYuan opens, and the command executes.

Expected Output: The calculator application (calc.exe) will launch on the victim's machine, demonstrating RCE.

Post-Exploitation: An attacker can execute any command, including:

• Downloading and executing malware.
• Exfiltrating files.
• Establishing a persistent backdoor.
• Pivoting to other systems on the network.

Blue Team Section

Detection:

• Log Entries: Monitor for SiYuan process creation events with unusual command-line arguments containing siyuan://plugins/ and suspicious icon parameters.
• Network Traffic: Look for outbound connections from the SiYuan process to unknown IPs (post-exploitation C2).
• Endpoint Behavioral Indicators: Unexpected child processes spawned by siyuan.exe (e.g., cmd.exe, powershell.exe, calc.exe).

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE_2026_65606_SiYuan_Exploit {
    meta:
        description = "Detects exploitation of CVE-2026-65606 in SiYuan via malicious siyuan:// links"
        author = "Valters IT Hub"
        date = "2026-07-23"
        reference = "https://www.valtersit.com/cve/cve-2026-65606"
    strings:
        $protocol = "siyuan://plugins/" ascii wide nocase
        $xss_payload = "onerror=" ascii wide nocase
        $node_access = "require('child_process')" ascii wide nocase
    condition:
        all of them
}

Sigma Rule (SIEM)

title: CVE-2026-65606 SiYuan Exploitation via Protocol Handler
id: e1fa1859-dc72-4b5e-9e48-1e0e571500b3
status: experimental
description: Detects exploitation attempts targeting CVE-2026-65606 in SiYuan by monitoring for malicious siyuan:// links in process creation events.
author: Valters IT Hub
date: 2026-07-23
references:
    - https://www.valtersit.com/cve/cve-2026-65606
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\siyuan.exe'
        CommandLine|contains: 'siyuan://plugins/'
    condition: selection
falsepositives:
    - Legitimate use of siyuan://plugins/ links to install plugins (rare)
level: high

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-65606 SiYuan Exploitation Attempt"; content:"siyuan://plugins/"; content:"onerror="; content:"require('child_process')"; classtype:attempted-user; sid:1000001; rev:1;)

Elastic (EQL) Query

process where event.type == "start" and process.parent.name == "siyuan.exe" and process.command_line : "*siyuan://plugins/*"

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| search ParentProcessName="*\\siyuan.exe" CommandLine="*siyuan://plugins/*"
| table _time, User, ParentProcessName, CommandLine

Wazuh Rule

<group name="siyuan,">
  <rule id="100001" level="12">
    <if_sid>4688</if_sid>
    <field name="win.eventdata.parentProcessName" type="pcre2">(?i)\\siyuan\.exe</field>
    <field name="win.eventdata.commandLine" type="pcre2">(?i)siyuan://plugins/</field>
    <description>CVE-2026-65606: SiYuan exploitation attempt detected</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

1. Patch: Upgrade SiYuan Desktop to version 3.7.2 or later.
   • Windows: Download from the official SiYuan website and run the installer.
   • Linux/macOS: Use the package manager or download the updated AppImage/DMG.
2. Compensating Control: If patching is not immediately possible, disable the siyuan:// protocol handler.
   • Windows: Delete or rename the registry key HKEY_CLASSES_ROOT\siyuan.
   • Linux: Remove the .desktop file associated with the siyuan:// scheme.
3. User Awareness: Immediately notify all SiYuan users not to click on any siyuan:// links from untrusted sources.

Short-term (1-7 days)

1. Configuration Hardening: Ensure nodeIntegration:false is set in the Electron BrowserWindow configuration if custom builds are used.
2. Monitoring: Implement the detection rules provided in this report to monitor for exploitation attempts.
3. Vulnerability Scanning: Run a scan to confirm all instances of SiYuan are updated.
   • Command: siyuan --version (should return 3.7.2 or higher).

Long-term

1. Architecture Changes: Consider using a sandboxed Electron configuration or a web-based version of SiYuan that does not have Node.js access.
2. Security Controls: Implement application allowlisting to prevent untrusted executables from being launched by SiYuan.
3. Developer Training: Educate developers on the dangers of innerHTML and the importance of secure Electron configurations.

Validation

• Check Version: Run siyuan --version and verify it returns 3.7.2 or later.
• Test Exploit: Attempt to trigger the vulnerability with a benign payload (e.g., siyuan://plugins/test?icon=x<img src=x onerror="alert(1)">). If the alert does not appear, the patch is effective.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65606
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-65606
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-65606 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1203/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-23 | https://www.valtersit.com/cve/cve-2026-65606