CVE-2026-109310: SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

Q: Who can exploit this issue?

A user with publish-reader access can exploit it. If publish authentication is disabled, anyone who can reach the affected endpoint can send the malicious request.

Q: What access and interaction are required for exploitation?

The attacker needs network access to the /api/icon/getDynamicIcon endpoint and must be able to submit a crafted content parameter. No victim interaction is required.

Q: What is the impact of a successful attack?

A single request can invoke uncapped Sprig template functions such as until to exhaust memory. This can cause the kernel to OOM-kill the affected system or process, resulting in denial of service.

Q: Which versions are affected?

SiYuan versions from v3.1.12 before v3.8.6 are affected.

Published Oct 12, 2026

Updated

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.

Affected Software

1 affected component

SiYuan SiYuan>=3.1.12<3.8.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SiYuan to a version that resolves this vulnerability.
Fixed in v3.8.6

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with publish-reader access can exploit it. If publish authentication is disabled, anyone who can reach the affected endpoint can send the malicious request.

What access and interaction are required for exploitation?

The attacker needs network access to the /api/icon/getDynamicIcon endpoint and must be able to submit a crafted content parameter. No victim interaction is required.

What is the impact of a successful attack?

A single request can invoke uncapped Sprig template functions such as until to exhaust memory. This can cause the kernel to OOM-kill the affected system or process, resulting in denial of service.

Which versions are affected?

SiYuan versions from v3.1.12 before v3.8.6 are affected.

CVE-2026-109310: SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and interaction are required for exploitation?

What is the impact of a successful attack?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and interaction are required for exploitation?

What is the impact of a successful attack?

Which versions are affected?