CVE-2026-74801: Siyuan-Note Siyuan

High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days.

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.

Affected products

• Siyuan-Note Siyuan: before 3.7.4 (fixed in 3.7.4)

Published 2026-08-17. Last modified 2026-08-26.