CVE-2026-86016

HighCVSS 8.2

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

VNote prior to 4.3.0 uses innerHTML assignment to insert YAML frontmatter metadata before the XSS protection runs. Opening a malicious Markdown file can execute stored JavaScript in the file:// viewer context, and due to LocalContentCanAccessRemoteUrls, the script can read local note files and transmit them to a remote server.

Risk Assessment

An attacker could steal the contents of local notes if the user opens a malicious file, potentially leading to disclosure of sensitive information.

Recommendation

Update VNote to version 4.3.0 or later, which includes the fix.

Other vulnerabilities in VNote

CVE-2026-86022High
VNote prior to 4.3.0 has a vulnerability where a note path is wrapped in double quotes and substituted into a command string that QProcess::start reparses. On Linux and macOS, an attacker can use a double quote in a filename to add arguments to the configured external program, potentially leading to arbitrary command execution.

Original NVD description (English source)

VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS