PT-2026-31734 · Microsoft+3 · Windows+3

Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-40107

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.4

Description SiYuan, a personal knowledge management system, prior to version 3.6.4, configured Mermaid.js with 'securityLevel: "loose"' and 'htmlLabels: true'. This configuration allowed tags with 'src' attributes to bypass internal sanitization and be injected into SVG blocks. The SVG was then injected using innerHTML without further sanitization. When a user opened a note containing a malicious Mermaid diagram, the Electron client fetched the URL. On Windows systems, a protocol-relative URL (//attacker.com/image.png) was interpreted as a UNC path (attacker.comimage.png), triggering automatic SMB authentication and potentially sending the victim's NTLMv2 hash to the attacker.

Recommendations Update SiYuan to version 3.6.4 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40107

GHSA-W95V-4H65-J455

Affected Products

Electron

Mermaid.Js

Siyuan

Windows

References · 5

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w95v-4h65-j455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40107 · Security Note
• https://osv.dev/vulnerability/GHSA-w95v-4h65-j455 · Vendor Advisory
• https://github.com/siyuan-note/siyuan · Note
• https://twitter.com/CVEnew/status/2042561850743885859 · Twitter Post