Description

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-17T11:16:40.323Z",
  "pubdate": "2026-08-17T11:16:40.323Z",
  "executiveSummary": "SiYuan before 3.7.4 suffers from a command injection vulnerability stemming from improper escaping of workspace directory paths when constructing command-line arguments for the elevated helper process.\nThe vulnerability allows an attacker to execute arbitrary commands with administrator privileges, leading to complete system compromise under specific conditions.\nThe affected product is SiYuan in versions prior to 3.7.4, specifically involving the privilege escalation component elevator.exe.\nThe risk implications are severe, as successful exploitation results in local privilege escalation from a standard user to administrator privileges.\nAttacker capabilities require the ability to create a malicious workspace directory containing command metacharacters within its file path.\nExploitation requirements dictate that the victim must trigger the Microsoft Defender exclusion flow, which subsequently interacts with the vulnerable helper process and processes the unescaped path arguments.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient sanitization and improper escaping of workspace directory paths within the application logic of SiYuan before 3.7.4.\nWhen the application constructs command-line arguments to invoke the privileged helper process, identified as elevator.exe, it fails to neutralize command metacharacters embedded within the directory path string.\nThe vulnerable component is the integration mechanism between the main SiYuan application and the administrative helper executable elevator.exe, specifically during operations that interact with security features such as the Microsoft Defender exclusion flow.\nExploitation occurs when an attacker crafts a malicious workspace directory containing specific command metacharacters in its filesystem path.\nThe attack flow proceeds as follows: First, the attacker establishes the malicious workspace directory with the engineered path containing command injection payloads. Second, the user or automation triggers the Microsoft Defender exclusion flow within SiYuan. Third, SiYuan programmatically constructs command-line parameters utilizing the unescaped workspace directory path to invoke elevator.exe. Fourth, because the underlying operating system executes the command string through an interpreter without proper quoting or escaping, the injected metacharacters are interpreted as command separators or arguments. Finally, the operating system executes the arbitrary command payload with the administrative privileges inherited by the elevated elevator.exe process.\nAuthentication requirements are minimal, as the attack relies on local filesystem manipulation to create the malicious directory structure.\nPrivilege requirements for the initial phase involve standard user access capable of creating workspace directories, while the resulting execution achieves administrative privileges following explicit User Account Control (UAC) approval.\nNetwork exposure is not a factor, as the vulnerability is strictly local and depends on filesystem paths and local process invocation.\nPost-exploitation impact includes full administrative control over the host operating system, enabling arbitrary code execution, persistence installation, data exfiltration, and lateral movement."
}