CVE-2026-82649

Executive Summary

CVE-2026-82649 is a local privilege escalation vulnerability affecting the SiYuan Windows installer (all versions from 2.0.14 up to, but not including, 3.8.1). The flaw resides in the NSIS installer's uncontrolled search path behavior: system executables such as TASKKILL are invoked by name rather than by absolute path, allowing a malicious binary planted in the installer's launch directory to be executed in place of the legitimate system utility. Because the vulnerable code executes in an all-users (elevated) install context before the license page is displayed, an attacker who can place a file in the installer's directory achieves code execution with elevated privileges. The vulnerability is currently unpatched, with no public exploit code, no CISA KEV listing, and no CVSS score assigned. This report provides technical analysis, exploitation scenarios, detection guidance, and mitigation recommendations for enterprise defenders.

Technical Analysis

The vulnerability class is CWE-427 (Uncontrolled Search Path Element). The NVD description specifies that the SiYuan Windows installer uses NSIS (Nullsoft Scriptable Install System) as its packaging framework. Within that NSIS script, system executables — explicitly named as TASKKILL — are invoked through the NSIS nsExec::Exec command using only the executable's base name (e.g., TASKKILL) rather than an absolute path (e.g., C:\Windows\System32\taskkill.exe).

The mechanism of the flaw hinges on Windows' DLL/executable search order combined with NSIS's runtime directory handling. When nsExec::Exec is used to launch a command, NSIS resolves the command name using the standard Windows search path. Critically, the current working directory and, in the context of an installer, the directory containing the installer executable itself (the "launch directory") are searched before the System32 directory. If an attacker has the ability to plant a file named TASKKILL.exe (or whatever legitimate system utility name is invoked) into the same directory where the SiYuan installer resides, then when the installer runs and reaches the nsExec::Exec call, Windows will resolve TASKKILL to the attacker's planted binary instead of the genuine system utility.

The NVD description indicates these nsExec calls occur within electron-builder's preInit hook. This is a specific stage of the electron-builder framework (used to package Electron applications such as SiYuan into NSIS installers) that executes before the installer's license page is displayed. From a privilege perspective, when the user chooses an "all-users" (elevated) installation, the installer process runs with an elevated token (e.g., via UAC prompt). Because the malicious binary inherits the elevated token of the installer process, the attacker's planted executable executes with elevated privileges — yielding local privilege escalation from a low-privileged position (ability to write to the directory where the installer is saved) to SYSTEM-level execution or at least admin-level execution.

Attack surface: The attacker must be able to write a file into the same directory as the SiYuan installer executable. In practical terms, this includes scenarios where an installer is downloaded to a shared/temp directory (e.g., C:\Users\Public\Downloads, C:\Temp), a network share, or a USB drive — locations where a non-privileged user or a separate low-privileged process may have write access. The exploitation is local; no network component is required.

Exploitation Scenarios

Note: No public PoC or exploit code is available. The following attack chain is inferred strictly from the vulnerability class (CWE-427) and the technical details in the NVD description. Specific file names, hooks, and execution steps beyond those mentioned in the description are not fabricated.

Step 1 — Reconnaissance / Target Identification: The attacker identifies a target organization using SiYuan on Windows (version >= 2.0.14 and < 3.8.1) or determines that a SiYuan installer package will be deployed in an environment. The attacker also locates a directory where the installer will be stored and where they can write files — common candidates include a shared download directory (C:\Users\Public\Downloads), a network file share used for software distribution, or a USB distribution drive. The attacker requires write access to that directory but does not require elevated privileges at this stage.

Step 2 — Flaw Trigger: The attacker plants a malicious executable in that directory and names it TASKKILL.exe (or another system utility name invoked by the NSIS installer, per the NVD description, TASKKILL is explicitly named). The attacker does not need to rename or modify the legitimate SiYani installer itself. When a user (or automated deployment tool) runs the SiYuan installer from that directory, the NSIS script proceeds. Reaching the preInit hook, the nsExec::Exec call attempts to run TASKKILL. Due to the Windows search path order, the planted TASKKILL.exe in the launch directory is resolved first, before System32\taskkill.exe.

Step 3 — Payload/Execution: The malicious TASKKILL.exe executes in the context of the installer process. If the user selects the "all-users" (elevated) installation option, the installer process has already been elevated (typically via a UAC prompt the user accepts). The planted binary therefore executes with an elevated token, inheriting the installer's privileges. At the vulnerability-class level, the payload is a stand-alone executable (PE file) that can contain arbitrary attacker code — e.g., adding a local administrator account, installing a backdoor, disabling security tooling, or exfiltrating local credentials.

Step 4 — Post-Exploitation Impact: With elevated (likely SYSTEM-level) execution, the attacker gains full control of the host. This allows persistence mechanisms (service installation, scheduled tasks, registry run keys), lateral movement within the network, credential harvesting, and data exfiltration. The local privilege escalation turns an initial foothold in a writable directory into host compromise. The attack does not require user interaction beyond the user running the installer with accepted UAC elevation, which is standard behavior for software installation.

Proof of Concept Intelligence

No public proof-of-concept is currently available for this vulnerability. There is no Nuclei template, no exploit code, and no documented in-the-wild exploitation. The EPSS score has not yet been issued by FIRST.org.

Why exploitation may still be possible: The flaw is inherent to how the NSIS installer was authored — it calls system executables by name rather than absolute path. This is a deterministic behavioral issue of Windows process spawning; it will manifest every time the installer runs in a directory containing a maliciously named executable. The absence of a published PoC does not reduce the exploitability; it only means no researcher or threat actor has publicly released a demonstration. Given that the vulnerability has been known (as of this CVE record) and the affected component (NSIS installers) is commonly analyzed, weaponization by sophisticated actors is plausible, especially in enterprise environments where software is distributed via writable network shares.

What defenders should monitor:

• Monitor public vulnerability databases (NVD, GitHub Advisories) for updates to CVE-2026-82649 and for the release of a SiYuan patched version (>= 3.8.1).
• Monitor GitHub and other code-hosting platforms for public PoC repositories referencing SiYuan or NSIS preInit hook exploitation.
• Monitor security research mailing lists and Twitter/X security researcher communities for write-ups on CWE-427 in NSIS installers generally, as techniques may be adapted.
• Monitor VirusTotal and malware sandbox communities for samples named TASKKILL.exe or similar system-utility lookalikes that appear in installer directories.

Impact Assessment

Business Impact: Successful exploitation results in local privilege escalation from a standard user to SYSTEM or administrative privileges on the affected Windows host. This is a severe integrity and confidentiality impact: an attacker gains full control of the affected machine, can install persistent malware, and can move laterally across the enterprise.

Affected Systems: All SiYuan Windows installer versions >= 2.0.14 and < 3.8.1. SiYuan is a note-taking and knowledge-management application popular with developers and technical professionals; it may be distributed in enterprises via software management tools, network shares, or direct downloads.

Blast Radius: The scope is per-host. However, in enterprise environments where the installer is distributed via a shared network path (e.g., a software distribution share) or where multiple users download to a common temp directory, a single planted malicious executable could compromise every host that subsequently runs the installer from that location. This creates a supply-chain-adjacent distribution risk.

CVSS: No CVSS score has been assigned (CVSS Score: N/A, Vector: N/A). Based on the described mechanism (local attack, low complexity, no user interaction beyond running the installer, high impact on confidentiality/integrity/availability), a reasonable estimated CVSS:3.1 score would be in the 7.0–7.8 range (High), but this is an estimate only — defenders should not treat N/A as "no risk."

Detection Guidance

Sigma Rule

title: Suspicious System Utility Execution from Non-System32 Directory via NSIS Installer
id: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects execution of system utility names (e.g., TASKKILL.exe) from directories other than System32, indicative of CVE-2026-82649 exploitation in SiYuan NSIS installers.
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\TASKKILL.exe'
            - '\taskkill.exe'
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    filter:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter
falsepositives:
    - Legitimate TASKKILL execution from a custom script located in a temp directory
    - Users copying taskkill.exe manually to another directory
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.82649
    - cwe.427

YARA Rule

rule CVE_2026_82649_SiYuan_NSIS_Taskkill_Lookalike
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects malicious executable masquerading as taskkill.exe for CVE-2026-82649 NSIS installer exploitation"
        cve = "CVE-2026-82649"
        date = "2026-01-01"
        severity = "high"
    strings:
        $pe_mz = { 4D 5A }  // MZ header
        $taskkill_name = "taskkill" ascii nocase
        $siyuan_ref = "siyuan" ascii nocase
        $nsis_ref = "nsExec" ascii nocase
    condition:
        uint16(0) == 0x5A4D and
        $taskkill_name and
        not $siyuan_ref and
        not $nsis_ref and
        filesize > 1KB and filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82649 Potential SiYuan Installer Related Malware Download"; content:"siyuan"; nocase; sid:2026826491; rev:1; metadata: cve CVE-2026-82649;)

Note: Since CVE-2026-82649 is a purely local vulnerability, network-based detection (Suricata) has limited direct applicability. The rule above is a coarse HTTP heuristic for file downloads that may be part of a distribution chain. The primary detection surface is host-based (process creation and file system auditing).

Elastic EQL Rule

process where event.action == "start" and process.name in ("taskkill.exe", "TASKKILL.exe")
  and not string::startsWith(process.executable, "C:\\Windows\\System32\\")
  and not string::startsWith(process.executable, "C:\\Windows\\SysWOW64\\")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where match(New_Process_Name, "(?i)taskkill\.exe")
| where NOT match(New_Process_Name, "(?i)^C:\\Windows\\(System32|SysWOW64)\\")
| table _time, host, user, New_Process_Name, Parent_Process_Name, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sysmon,privilege_escalation,">
    <rule id="100826" level="12">
        <if_sid>92050</if_sid> <!-- Windows process creation -->
        <field name="win.event.image" type="pcre2">(?i)taskkill\.exe</field>
        <match>!C:\\Windows\\System32\\</match>
        <match>!C:\\Windows\\SysWOW64\\</match>
        <description>CVE-2026-82649: taskkill.exe executed from a non-System32 directory - possible NSIS installer privilege escalation</description>
        <group>windows,attack.privilege_escalation,</group>
        <mitre>
            <id>T1068</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vulnerable versions are >= 2.0.14 and < 3.8.1; version 3.8.1 is the first known fixed version per the NVD description, but no official patch advisory has been published by the vendor (unknown vendor publishing channel). Do not assume that simply upgrading to 3.8.1 is sufficient without verifying the vendor's official changelog; however, the NVD description explicitly states "before version 3.8.1," implying 3.8.1 and later are not affected.

Immediate Mitigations (before patch is available/verified):

1. Restrict installer directory write permissions: Ensure directories where SiYuan installer packages are placed (downloads, network shares, temp directories) are write-protected for standard users. Only administrators should be able to place or rename files in those directories.
2. Download and run the installer from a trusted, hardened location: Direct the installer to run from C:\Program Files\ or another directory where only administrators have write access.
3. Do not install SiYuan from network shares or USB drives that are writable by non-privileged users.
4. Run the installer with the least privilege necessary: Prefer a per-user (non-elevated) install over an all-users (elevated) install if the environment permits; this limits the privilege escalation impact.
5. Deploy application whitelisting (e.g., WDAC / AppLocker) to block execution of taskkill.exe (or any system utility names) from non-System32 directories.
6. Monitor for the presence of system-utility-named files in unusual directories via file integrity monitoring (FIM).

Patch/Upgrade Steps:

• When a verified patched version is available, upgrade SiYuan to version 3.8.1 or later. Verify the integrity of the installer package (check hash signatures) before running it.
• Obtain the installer only from the official SiYuan distribution channel.
• Re-run the upgrade from a clean, write-restricted directory.

Long-Term Hardening:

• Adopt a centralized software distribution solution that stages installers in controlled, read-only directories with hash verification.
• Enforce baseline Windows security configurations: enable UAC, restrict standard users from writing to directories commonly used for installer staging.
• Implement host-based detection rules (Sigma, EQL, SPL, Wazuh above) to flag anomalous system utility executions.
• Monitor the SiYuan project for future security advisories and CVE updates. No known threat actor campaigns have been attributed to this CVE; no exploit-in-the-wild evidence exists to date.

References

1. NVD Entry for CVE-2026-82649 — https://nvd.nist.gov/vuln/detail/CVE-2026-82649 (Authoritative source for the vulnerability description; check periodically for CVSS and patch updates).
2. SiYuan Official Website / GitHub Repository — https://github.com/siyuan-note/siyuan (Monitor for release notes confirming the 3.8.1 fix and for official security advisories).
3. MITRE CWE-427 — https://cwe.mitre.org/data/definitions/427.html (Uncontrolled Search Path Element — vulnerability class reference for defensive engineering).
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-82649 is not currently listed; monitor in case of future in-the-wild exploitation).
5. Electron-builder NSIS Documentation — https://www.electron.build/nsis (Reference for the preInit hook and nsExec::Exec behavior; useful for defenders analyzing installer internals).

Threat Actor / Exploit-in-the-Wild Status: No known threat actor campaigns have been attributed to CVE-2026-82649. No evidence of exploitation in the wild has been published as of this report. The lack of a CISA KEV listing confirms no federal-acknowledged active exploitation.