CVE-2026-66395 is a reflected cross-site scripting vulnerability affecting SiYuan desktop prior to version 3.7.2. The issue exists in the bazaar plugin readme handler, where an attacker can craft a malicious siyuan:// deep link containing a plugin name parameter with embedded HTML payloads. These payloads are rendered using insertAdjacentHTML in an Electron renderer that is insecurely configured, allowing execution of arbitrary code with full Node.js access. This elevates the risk significantly as it enables potentially complete control over the affected system. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary code with full Node.js privileges on the victim's machine by injecting malicious HTML through a crafted deep link. This can lead to complete compromise of the affected system, including data theft, system manipulation, or further malware deployment. The vulnerability is exploitable without privileges and requires only user interaction (clicking a malicious link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted siyuan:// deep links and disable or restrict usage of the bazaar plugin if possible. Monitor vendor channels for updates regarding an official patch or mitigation.