CVE-2026-82649

SiYuan's Windows NSIS installer in versions from 2.0.14 up to (but not including) 3.8.1 invokes system executables such as TASKKILL by name rather than by absolute path, creating an uncontrolled search path element (CWE-427). Because NSIS nsExec::Exec resolves these names using a search path that places the directory the installer was launched from ahead of System32, a local attacker who can write a file into that directory can have a planted executable (e.g., a renamed TASKKILL.exe) executed whenever the installer runs. The vulnerable calls fire in electron-builder's preInit hook before the license page is displayed, and in an all-users (elevated) install the planted binary executes with an elevated token, giving an attacker who already has low-privilege access on the machine local privilege escalation. Anyone who runs an affected SiYuan Windows installer from a directory writable by such an attacker is exposed; the flaw is rated 7.0 (High) on CVSS 4.0 with a local attack vector, low privileges required, and user interaction. No public proof of concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates only about a 0.1 percent chance of exploitation within 30 days, so there is no current evidence of in-the-wild exploitation.

What to do: Windows users should upgrade SiYuan to version 3.8.1 or later. Until then, run the installer only from directories that unprivileged users and malware cannot write to (avoid user-writable folders such as Downloads), especially for all-users installs where the planted binary inherits the elevated token. Because exploitation requires an attacker with low-privilege access plus a user launching the installer, prioritize shared workstations where unprivileged users can elevate, and check for unexpected TASKKILL.exe or similarly renamed binaries in directories from which installers have been run.