CVE-2026-82649: Uncontrolled Search Path Element in siyuan-note siyuan

The SiYuan Windows installer before version 3.8.1 (affecting versions >= 2.0.14) uses NSIS nsExec::Exec to invoke system executables such as TASKKILL by name rather than absolute path. Because the search path prioritizes the installer's launch directory over System32, an attacker who places a malicious executable named like a system binary in that directory can have it executed with elevated privileges during installation. This occurs in the electron-builder's preInit hook before the license page is shown, enabling local privilege escalation when installing for all users.

An attacker with write access to the installer's launch directory can execute arbitrary code with elevated privileges during installation. This local privilege escalation can compromise system integrity by allowing unauthorized actions with higher permissions than the attacker originally possesses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the vulnerable installer in untrusted directories or environments where an attacker could place malicious executables. Prefer installing from trusted sources and verify installer integrity.