Reflected XSS to OS RCE in SiYuan desktop via siyuan:// deep link (CVE-2026-66395)

The SiYuan desktop app registers `siyuan://` as an OS-level protocol handler and reflects an attacker-controlled path segment from `siyuan://bazaar/plugins/<payload>/readme` URLs verbatim into a `showMessage` call that uses `insertAdjacentHTML` as its sink. Because every BrowserWindow is created with `nodeIntegration:true`, `contextIsolation:false`, `webSecurity:false`, and no Content Security Policy, injected HTML executes with `window.require("child_process")` and full OS access at the user's privilege level. An attacker who can induce a user to click a crafted deep link achieves arbitrary OS-level code execution without further authentication. Affected versions: - 3.7.1 We recommend updating to: v3.7.2. CVSS 9.4 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gx2-8gcr-x83f Details: https://vuln.today/cve/CVE-2026-66395