CVE-2026-40107: SSRF in SiYuan Kernel

An attacker can exploit this SSRF vulnerability by crafting a malicious Mermaid diagram containing an <img> tag with a protocol-relative URL. When a victim opens a note containing this diagram within the SiYuan Electron client, the client will attempt to fetch the image from the attacker-controlled URL. Critically, on Windows systems, a protocol-relative URL (//attacker.com/image.png) resolves to a UNC path (\\attacker.com\image.png), triggering an automatic SMB authentication attempt. This exposes the victim's NTLMv2 hash to the attacker, facilitating potential credential theft and lateral movement within the network. The blast radius extends to any systems accessible via SMB from the compromised SiYuan client.

1. Reserved2026-04-09
2. Published2026-04-10
3. EPSS updated2026-04-17

The primary mitigation for CVE-2026-40107 is to upgrade SiYuan Kernel to version 0.0.0-20260407035653-2f416e5253f1 or later. If an immediate upgrade is not feasible, consider temporarily disabling Mermaid diagrams within SiYuan or restricting the URLs that can be accessed via Mermaid.js. While not a complete solution, configuring a Web Application Firewall (WAF) to block requests to suspicious URLs or restrict access to SMB ports could provide an additional layer of defense. After upgrading, confirm the fix by attempting to load a note containing a malicious Mermaid diagram with a protocol-relative URL; the request should be blocked or sanitized.