CVE-2026-82649: SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path
SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a search path that includes the installer's own launch directory ahead of System32, an attacker who plants a malicious executable (e.g., a renamed TASKKILL.exe) in that directory can have it executed when the installer runs. These calls occur in electron-builder's preInit hook before the license page is displayed, and with an all-users (elevated) install the planted binary executes with an elevated token, resulting in local privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.1 - Compensating control
Before upgrading to SiYuan 3.8.1, ensure the NSIS/installer launch directory (the launch directory that is ahead of System32 in the uncontrolled search path) does not contain attacker-planted executables (e.g., a renamed TASKKILL.exe).
Event History
Frequently Asked Questions
Who is exposed to elevated code execution?
Windows systems where an affected installer is run as an all-users installation are exposed. In that elevated installation mode, a planted executable is run with an elevated token.
What does an attacker need to exploit this issue?
The attacker needs to place a malicious executable with the name of a invoked system command, such as TASKKILL.exe, in the directory from which the installer is launched. The installer then resolves that local file before the legitimate System32 executable.
Does exploitation require the user to proceed through the installer?
No. The vulnerable calls occur in electron-builder's preInit hook, before the license page is shown, so the planted executable can run as soon as the installer starts.
How can I determine whether an installer is affected?
Affected SiYuan Windows installer versions are 2.0.14 through versions before 3.8.1. Version 3.8.1 and later are not identified as affected.