CVE-2026-40107— SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

SiYuan is a personal knowledge management system. Prior to 3.6.4, SiYuan configures Mermaid.js with securityLevel: "loose" and htmlLabels: true. In this mode, <img> tags with src attributes survive Mermaid's internal DOMPurify and land in SVG <foreignObject> blocks. The SVG is injected via innerHTML with no secondary sanitization. When a victim opens a note containing a malicious Mermaid diagram, the Electron client fetches the URL. On Windows, a protocol-relative URL (//attacker.com/image.png) resolves as a UNC path (\\attacker.com\image.png). Windows attempts SMB authentication automatically, sending the victim's NTLMv2 hash to the attacker. This vulnerability is fixed in 3.6.4.

N/A

服务端请求伪造(SSRF)

SiYuan 代码问题漏洞

SiYuan是SiYuan开源的一个隐私至上的个人知识管理系统。 SiYuan 3.6.4之前版本存在代码问题漏洞，该漏洞源于Mermaid.js配置不安全且缺少二次清理，可能导致Windows系统上的NTLMv2哈希泄露。

N/A

N/A