CVE-2026-86022: high-severity vulnerability in vnotex vnote
VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7epss 0.2%
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
vnotex · vnoteRelated CVEs — vnotex vnote
In the same product, most dangerous first.
CVE-2024-41662HIGHVNote vulnerable to Markdown XSS, which leads to RCEEPSS 1.7%CVE-2023-5701MEDIUMvnotex vnote Markdown File cross site scriptingEPSS 0.8%CVE-2024-39904HIGHCode Execution Vulnerability via Local File Path Traversal in VnoteEPSS 0.7%CVE-2026-15505MEDIUMvnotex vnote YAML Frontmatter markdownit.js cross site scriptingEPSS 0.3%CVE-2026-86016HIGHVNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote ExfiltrationEPSS 0.3%