CVE-2026-109310

Name of the Vulnerable Software and Affected Versions SiYuan versions 3.1.12 through 3.8.5

Description Insufficient restriction of the Sprig template function map in the /api/icon/getDynamicIcon endpoint via the content parameter allows for resource exhaustion. An attacker with publish reader permissions, or any user if publish authentication is disabled, can utilize uncapped functions such as until to trigger an Out-Of-Memory (OOM) condition, potentially causing the kernel to terminate the process with a single request.

Recommendations Update SiYuan to version 3.8.6 or later. As a temporary mitigation, restrict access to the /api/icon/getDynamicIcon endpoint or avoid using the content parameter until the update is applied.