Description
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | 3.1.12 – < 3.8.6 | 3.8.6 |
References
- GitHub Security Advisory (GHSA-cxwr-r7cq-xw52) vendor-advisory
- VulnCheck Advisory: SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template third-party-advisory