SiYuan CVE-2026-109310

Requires the attacker to be able to reach the /api/icon/getDynamicIcon endpoint and supply a malicious Sprig template in the content parameter. In the default configuration a publish-reader-level account is needed (PR:L); the limiting factor is that SiYuan's publishing/sharing feature must be in use and the attacker must hold at least reader access to a published workspace. If the administrator has disabled publish authentication, this limiting factor is removed and any remote unauthenticated user can trigger it. The vulnerability is network-reachable with low complexity and no user interaction, but is gated by exposure of the publish interface to the attacker and by the absence of the function-map restriction present in 3.8.6+.

This is a denial-of-service vulnerability (CWE-770, uncontrolled resource consumption) rather than a code-execution or data-exposure flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low complexity, requires low privileges (a publish reader), no user interaction, and the only impact is high availability loss - confidentiality and integrity are untouched. The 7.1 score is driven entirely by the VA:H availability impact. No EPSS probability, KEV listing, or SSVC decision point was supplied, and there is no indication of a public proof-of-concept, so the real-world exploitation likelihood cannot be quantified from the inputs - treat the absence of these signals as missing data, not as evidence of low risk. One important nuance: the CVSS vector encodes PR:L (authenticated low-privilege), but the description states exploitation is possible by 'anyone when publish auth is disabled,' meaning in that non-default configuration the effective requirement drops to PR:N. Overall this is a genuine but bounded operational risk - a single request can crash the kernel - yet it is a self-hosted note-taking application, not internet-scale infrastructure, so it is a patch-promptly issue rather than an emergency for most deployments.

An attacker holding publish-reader access to a self-hosted SiYuan instance (version 3.1.12 up to but not including 3.8.6) sends a single crafted request to /api/icon/getDynamicIcon whose content parameter contains a Sprig template invoking an uncapped function such as 'until', forcing the kernel to allocate unbounded memory until the OS OOM-killer terminates the process. If publish authentication has been disabled, any unauthenticated remote user can do the same. No public exploit code was identified at time of analysis, though the technique is straightforward given the detailed advisory.