Denial of Service Vulnerability in SiYuan Version 3.1.12 by SiYuan Note

CVE-2026-109310

What is CVE-2026-109310?

The vulnerability in SiYuan versions prior to v3.8.6 allows for Denial of Service through the exploitation of the Sprig template function map in the /api/icon/getDynamicIcon content parameter. Attackers can invoke uncapped functions and potentially exhaust system resources, leading to an Out Of Memory (OOM) condition that can crash the kernel with a single request. This issue poses a significant risk, especially when publishing authorization is disabled, as it enables unauthorized users to trigger the vulnerability, compromising system stability.

References