CVE-2026-109310: SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.6
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with publish-reader access can exploit it. If publish authentication is disabled, anyone who can reach the affected endpoint can send the malicious request.
What access and interaction are required for exploitation?
The attacker needs network access to the /api/icon/getDynamicIcon endpoint and must be able to submit a crafted content parameter. No victim interaction is required.
What is the impact of a successful attack?
A single request can invoke uncapped Sprig template functions such as until to exhaust memory. This can cause the kernel to OOM-kill the affected system or process, resulting in denial of service.
Which versions are affected?
SiYuan versions from v3.1.12 before v3.8.6 are affected.