CVE-2026-82649
SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a search path that includes the installer's own launch directory ahead of System32, an attacker who plants a malicious executable (e.g., a renamed TASKKILL.exe) in that directory can have it executed when the installer runs. These calls occur in electron-builder's preInit hook before the license page is displayed, and with an all-users (elevated) install the planted binary executes with an elevated token, resulting in local privilege escalation.
- CVSS 4.0
- 7.0 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.12% probability · 2th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-427
- Source
- disclosure@vulncheck.com
References
- https://github.com/siyuan-note/siyuan/commit/251596fc0de2f9528c00c224252fd073a99973f4
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9j65-967f-5rv3
- https://www.vulncheck.com/advisories/siyuan-before-3.8.1-local-privilege-escalation-via-uncontrolled-search-path
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9j65-967f-5rv3
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.