CVE-2026-74801CWE-78command-injection

CVE-2026-74801

High · published August 17, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
10.0
In the wild
Unconfirmed
What it is

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00205 · 10.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-17T15:16Z
References (3)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vmp7-pm7g-ghcc · [email protected]https://www.vulncheck.com/advisories/siyuan-before-local-privilege-escalation-via-elevator-exe · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vmp7-pm7g-ghcc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 AUG 11:04Z
    SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe
    cvelistv5