CVE-2026-74801: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in siyuan-note siyuan
SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.
AI Analysis
Technical Summary
The vulnerability in SiYuan prior to version 3.7.4 arises from improper neutralization of special elements in workspace directory paths used in command-line arguments for the elevated elevator.exe helper process. Attackers can exploit this by creating a workspace directory with embedded command metacharacters, which leads to execution of arbitrary OS commands with elevated privileges following UAC confirmation. This is classified as an OS command injection vulnerability with a CVSS 4.0 base score of 8.6, indicating high severity.
Potential Impact
Successful exploitation allows an attacker with limited privileges to execute arbitrary commands on the system with administrator-level privileges after the user approves the UAC prompt. This can lead to full system compromise, unauthorized actions, and potential persistence.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted workspace directory names containing special characters and exercise caution when approving UAC prompts related to SiYuan. Monitor vendor channels for updates regarding a patch or official mitigation.
CVE-2026-74801: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in siyuan-note siyuan
Description
SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.
CVSS v4.0
Score 8.6high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in SiYuan prior to version 3.7.4 arises from improper neutralization of special elements in workspace directory paths used in command-line arguments for the elevated elevator.exe helper process. Attackers can exploit this by creating a workspace directory with embedded command metacharacters, which leads to execution of arbitrary OS commands with elevated privileges following UAC confirmation. This is classified as an OS command injection vulnerability with a CVSS 4.0 base score of 8.6, indicating high severity.
Potential Impact
Successful exploitation allows an attacker with limited privileges to execute arbitrary commands on the system with administrator-level privileges after the user approves the UAC prompt. This can lead to full system compromise, unauthorized actions, and potential persistence.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted workspace directory names containing special characters and exercise caution when approving UAC prompts related to SiYuan. Monitor vendor channels for updates regarding a patch or official mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-16T12:59:42.223Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a82f001bf8831d539c482cd
Added to database: 08/17/2026, 11:26:57 UTC
Last enriched: 08/17/2026, 11:56:33 UTC
Last updated: 08/18/2026, 02:13:40 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.