Medium severity6.5NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2026-109310

Description

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.8.6

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-cxwr-r7cq-xw52nvd
www.vulncheck.com/advisories/siyuan-3.1.12-before-3.8.6-denial-of-service-via-getdynamicicon-templatenvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000