The vulnerability in SiYuan arises from an oversight in the /api/icon/getDynamicIcon endpoint, where the content parameter is rendered with an unrestricted Sprig template function map. This allows arbitrary Sprig functions, such as 'until', to be executed without limits. The result is a potential for uncontrolled resource consumption that can drive the system past its memory limits and eventually trigger an out-of-memory kill of the kernel, rendering the host unavailable.

Affected versions are SiYuan note releases from v3.1.12 through the last stable release before the patch, up to v3.8.5. All builds under the Siyuan package are impacted. The latest workaround is to upgrade to v3.8.6, where the Sprig function map has been properly bounded. Those still running earlier builds should isolate the API or remove templating support.

The CVSS score of 7.1 indicates a high impact on availability. Because the flaw can be triggered remotely via the publish endpoint and the EPSS is currently unavailable, the likelihood of exploitation is uncertain, but the lack of a KEV listing does not diminish the operational risk. An attacker who can send a crafted request to /api/icon/getDynamicIcon can directly exhaust system memory and cause a reboot or halt of the host, making this a critical DoS risk for any exposed instance.