Log in / Sign up

Vulnerability details

CVE-2026-40107

siyuan-note siyuan

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

CVSS 4.0
8.7High

Official description

SiYuan is a personal knowledge management system. Prior to 3.6.4, SiYuan configures Mermaid.js with securityLevel: "loose" and htmlLabels: true. In this mode, <img> tags with src attributes survive Mermaid's internal DOMPurify and land in SVG <foreignObject> blocks. The SVG is injected via innerHTML with no secondary sanitization. When a victim opens a note containing a malicious Mermaid diagram, the Electron client fetches the URL. On Windows, a protocol-relative URL (//attacker.com/image.png) resolves as a UNC path (\\attacker.com\image.png). Windows attempts SMB authentication automatically, sending the victim's NTLMv2 hash to the attacker. This vulnerability is fixed in 3.6.4.

CVSS scores

ScoreVersionSourceVector
8.7High 4.0 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

VendorProductVersionsSource
siyuan-note siyuan < 3.6.4 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-04-10
Last updated
2026-04-10
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.31%
Probability of exploitation in 30 days
24.8%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-918
    Server-Side Request Forgery (SSRF)