The vulnerability allows an unauthenticated attacker to open a WebSocket connection to the SiYuan kernel server when a specific 'auth keepalive' query parameter is supplied. Within an established connection, the server parses incoming JSON messages using unchecked type assertions. A crafted malformed message can trigger a runtime panic, causing the kernel process to crash and the service to become unavailable. The weakness is represented by CWE‑248 (Unchecked Return Value) and CWE‑306 (Missing Authentication for Critical Function). This results in a denial of service that can affect all users of the affected instance but does not provide the attacker with escalation or data exfiltration capabilities.

SiYuan, the personal knowledge management system, is affected. All versions of the SiYuan kernel WebSocket server released prior to 3.6.2 are vulnerable. The issue was addressed in version 3.6.2 by removing unauthenticated WebSocket access and validating message types.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of automated exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by establishing a WebSocket connection with the keepalive parameter, then sending crafted JSON payloads to induce a panic. The risk is particularly relevant for publicly exposed SiYuan servers that have not applied the patch, as the DoS can disrupt service availability for all users.