CVE-2026-65606 describes a cross-site scripting vulnerability in SiYuan note-taking software prior to version 3.7.2. The vulnerability arises in the siyuan:// protocol handler when a link to a non-installed plugin is processed. The application inserts the icon parameter from the link into the tab header using innerHTML without proper escaping, enabling injection of malicious HTML such as an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node.js require and execute arbitrary OS commands via require('child_process').execSync(...), significantly escalating the impact of the XSS.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the victim's machine due to the combination of XSS and nodeIntegration:true in the SiYuan Desktop renderer. This leads to a critical security risk including full system compromise. The vulnerability requires user interaction (UI:P) but no privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking untrusted siyuan:// links referencing non-installed plugins. Monitor vendor channels for updates and apply patches promptly once released.