What is CVE-2026-74801?

CVE-2026-74801 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under OS Command Injection. CVSS score: 8.2/10. Published 2026-08-17.

How severe is CVE-2026-74801?

High severity. CVSS v3 base score is 8.2 out of 10.

RCE in Siyuan-Note Siyuan

CVE-2026-74801

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.

Vulnerability class: Command Injection (OS Command Injection)

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

Affected products

Siyuan-note Siyuan — versions 0, 3.7.4

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-74801?: CVE-2026-74801 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under OS Command Injection. CVSS score: 8.2/10. Published 2026-08-17.
How severe is CVE-2026-74801?: High severity. CVSS v3 base score is 8.2 out of 10.