CVE-2026-82649
Received Received - Intake

SiYuan Windows Installer Uncontrolled Search Path Element

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulnCheck

Description
SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a search path that includes the installer's own launch directory ahead of System32, an attacker who plants a malicious executable (e.g., a renamed TASKKILL.exe) in that directory can have it executed when the installer runs. These calls occur in electron-builder's preInit hook before the license page is displayed, and with an all-users (elevated) install the planted binary executes with an elevated token, resulting in local privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82649
EUVD
EUVD-2026-68235

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan From 2.0.14 (inc) to 3.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the SiYuan Windows installer before version 3.8.1. The installer uses NSIS to call system executables like TASKKILL by name instead of absolute path. Because NSIS searches the installer's directory first, an attacker can place a malicious executable there. When the installer runs, especially with elevated permissions for all users, the malicious file executes with high privileges, leading to local privilege escalation.

Detection Guidance

Check for suspicious executables named TASKKILL.exe, cmd.exe, or powershell.exe in directories where SiYuan installer versions 2.0.14 to 3.8.0 might be launched. Inspect installer directories for unexpected files. Use process monitoring tools to detect elevated processes spawned by SiYuan installer.

Impact Analysis

An attacker could exploit this to gain elevated privileges on your system by tricking you into running the installer. This could allow them to take control of your computer, install malware, or access sensitive data. The attack requires minimal interaction, just launching the installer.

Compliance Impact

This vulnerability primarily enables local privilege escalation, which could allow unauthorized access to sensitive data or system functions. For GDPR, this could lead to unauthorized processing or access to personal data, violating principles of data protection and user rights. Under HIPAA, such an attack might compromise protected health information by granting unauthorized system access, potentially violating security rules for electronic protected health information.

Mitigation Strategies

Upgrade SiYuan to version 3.8.1 or later. Avoid running SiYuan installer versions 2.0.14 to 3.8.0 from untrusted directories. Scan systems for malicious executables named TASKKILL.exe, cmd.exe, or powershell.exe in installer paths. Do not use all-users elevated installation unless absolutely necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart