XSS to remote code execution in SiYuan Desktop via protocol handler (CVE-2026-65606)

SiYuan Desktop fails to escape the `icon` parameter from `siyuan://plugins/<name>` links before inserting it into the tab header via `innerHTML` in `app/src/layout/Tab.ts`. An attacker can inject an `<img onerror=...>` element carrying arbitrary JavaScript. Because the desktop renderer runs with `nodeIntegration: true`, the injected script gains access to Node.js's `require`, enabling escalation from cross-site scripting to arbitrary operating-system command execution. Affected versions: - <= 3.7.1 We recommend updating to: v3.7.2. CVSS 9.4 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wp64-x7qh-h728 Details: https://vuln.today/cve/CVE-2026-65606