Pl4Nty

**Name of the Vulnerable Software and Affected Versions** SiYuan Windows installer versions 2.0.14 through 3.8.0 **Description** The NSIS installer contains an uncontrolled search path element issue where system executables, such as TASKKILL, are invoked by name instead of by an absolute path. The `nsExec::Exec` function resolves these calls using a search path that prioritizes the installer's launch directory over System32. An attacker can place a malicious executable with the same name in the launch directory to achieve local privilege escalation, as the binary executes with an elevated token during an all-users installation. This occurs within the `preInit` hook of electron-builder before the license page is shown. **Recommendations** Update to version 3.8.1 or later.