Security Flaw in SiYuan Personal Knowledge Management System
CVE-2026-40107

8.7HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
9 April 2026

What is CVE-2026-40107?

The SiYuan Personal Knowledge Management System contains a vulnerability due to improper configuration of Mermaid.js. In versions prior to 3.6.4, it allows tags with src attributes to evade sanitization, which may lead to the injection of malicious SVG content. When a user interacts with such a note, the Electron client will fetch an attacker-controlled URL, potentially exposing the user's NTLMv2 hash to the attacker via SMB authentication. This vulnerability highlights significant risks associated with unvalidated external content and is resolved in version 3.6.4.

Affected Version(s)

siyuan < 3.6.4

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.