CVE-2026-109310— SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
Quick assessment
Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在思源笔记（SiYuan）v3.1.12 至 v3.8.6 版本之前，存在一个安全漏洞：/api/icon/getDynamicIcon 接口中的 content 参数未能有效限制 Sprig 模板函数的使用范围。攻击者可通过滥用无数量限制的函数（如 until）导致系统资源耗尽，甚至引发内存溢出（OOM），最终导致内核被强制终止（OOM-kill）。具有发布权限的读者，或在发布认证功能被禁用的情况下，任何人均可通过单次请求触发此漏洞。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| siyuan-note | siyuan | 3.1.12< 3.8.6 |
affected |
3.8.6 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109310
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 3.1.12 ~ 3.8.6 | - |
|
II. Public POCs for CVE-2026-109310
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109310
请登录查看更多情报信息。
Other References for CVE-2026-109310 (2)
IV. Related Vulnerabilities
Same product: siyuan
-
CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin R -
CVE-2026-105205
SiYuan before 3.8.5 Information Disclosure via /api/block/ge -
CVE-2026-104410
SiYuan before 3.8.5 Information Disclosure via /api/export/p -
CVE-2026-103762
SiYuan before v3.8.5 Missing Authorization in Save-Path Reso -
CVE-2026-103763
SiYuan before v3.8.5 Information Disclosure via /api/noteboo
Same vendor: siyuan-note
-
CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin R -
CVE-2026-105205
SiYuan before 3.8.5 Information Disclosure via /api/block/ge -
CVE-2026-104410
SiYuan before 3.8.5 Information Disclosure via /api/export/p -
CVE-2026-103762
SiYuan before v3.8.5 Missing Authorization in Save-Path Reso -
CVE-2026-103763
SiYuan before v3.8.5 Information Disclosure via /api/noteboo
Same weakness: CWE-770
-
CVE-2026-105466
IBM® Db2® is vulnerable to a denial of service when insertin -
CVE-2026-109351
Gitoxide gix-pack before 0.75.0 Denial of Service via Pack H -
CVE-2026-109339
SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealis -
CVE-2026-109228
SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video -
CVE-2026-109227
SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Vide
V. Comments for CVE-2026-109310
No comments yet