CVE-2026-40107

SiYuan is a personal knowledge management system. Prior to 3.6.4, SiYuan configures Mermaid.js with securityLevel: "loose" and htmlLabels: true. In this mode, <img> tags with src attributes survive Mermaid's internal DOMPurify and land in SVG <foreignObject> blocks. The SVG is injected via innerHTML with no secondary sanitization. When a victim opens a note containing a malicious Mermaid diagram, the Electron client fetches the URL. On Windows, a protocol-relative URL (//attacker.com/image.png) resolves as a UNC path (\\attacker.com\image.png). Windows attempts SMB authentication automatically, sending the victim's NTLMv2 hash to the attacker. This vulnerability is fixed in 3.6.4.

Affected products

Electron, Mermaid.Js, Siyuan, Windows

b3log Siyuan

< 3.6.4

Fix

Available

CVSS 4.0

8.7 HIGH

CVSS 3.1

6.5 MEDIUM

EPSS

0.3% (23th percentile)

Weakness

CWE-918

NVD status

Analyzed

Published

2026-04-09

No exploit for CVE-2026-40107 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.