EUVD-2026-60084
GHSA-pmhp-gmf7-7vhj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privilege required; scope changes to administrator via elevator.exe; user interaction required for UAC approval.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.
AnalysisAI
Local privilege escalation in SiYuan before 3.7.4 allows a low-privileged local attacker to execute arbitrary commands with administrator privileges by crafting a workspace directory whose path contains OS command metacharacters. When the victim triggers the Microsoft Defender exclusion workflow within SiYuan and approves the resulting UAC prompt, the application passes the unsanitized path to the elevated elevator.exe helper process, enabling command injection at administrator level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires four specific conditions: (1) the attacker must have local access as a low-privileged user (PR:L per CVSS vector); (2) the attacker must be able to create or control a SiYuan workspace directory whose filesystem path contains OS command metacharacters; (3) the victim user must explicitly trigger the Microsoft Defender exclusion workflow within the SiYuan application - this is not a passive or automatic action; and (4) the victim must approve the Windows UAC elevation prompt that SiYuan displays before invoking elevator.exe (UI:P per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) scores 8.6, with subsequent-system impact metrics all at High - indicating potential full system compromise beyond the SiYuan process itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a local low-privileged account creates a SiYuan workspace at a path such as C:\legit\dir & calc.exe & - embedding an arbitrary command in the directory name using shell metacharacters. When the targeted user later navigates the SiYuan interface to add a Microsoft Defender exclusion for that workspace and clicks through the resulting UAC prompt, SiYuan passes the unsanitized path string to elevator.exe, which causes the injected command (in this example, calc.exe, or a more malicious payload) to execute with administrator privileges. … |
| Remediation | The primary remediation is to upgrade SiYuan to version 3.7.4 or later, which addresses the command injection by properly escaping workspace directory paths before passing them to elevator.exe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure to identify all SiYuan deployments running versions prior to 3.7.4. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today